Abnormal data interception method, device and computer equipment of cloud resource pool

Abstract

The application relates to an abnormal data interception method and device of a cloud resource pool and computer equipment. The method comprises the following steps: acquiring current network data flow of the cloud resource pool, and performing data splitting processing on the network data flow to obtain a plurality of sub-data groups corresponding to security cores; based on the sub-data groups corresponding to the security cores, each local clustering center corresponding to each security core is identified through a clustering algorithm, and based on the local clustering center corresponding to each security core, each optimal local clustering center corresponding to each security core is screened through a center index optimization algorithm; each target clustering center of the current network data flow is identified in the optimal local clustering centers through a particle swarm algorithm, and based on the target clustering centers, abnormal data information in each sub-data group is screened as invasion suspicious data information of the network data flow. The method can improve the invasion prevention effect of the cloud resource pool.

Description

Technical Field

[0001] This application relates to the fields of cloud resource pools and intrusion prevention and detection technology, and in particular to a method, apparatus and computer equipment for intercepting abnormal data in cloud resource pools. Background Technology

[0002] Intrusion Prevention System (IPS) is a network security technology designed to monitor network traffic and system activity to detect and defend against malicious attacks and threats. With the rapid increase in the usage and wider adoption of enterprise cloud resource pools, and the resulting massive amounts of network traffic data, traditional intrusion detection systems struggle to meet the requirements of low latency, high real-time performance, and the extraction of effective behavioral features from high-dimensional, massive datasets. Therefore, ensuring the effectiveness of intrusion prevention for cloud resource pools is a current research focus.

[0003] Traditional intrusion prevention methods for cloud resource pools involve adding data permission verification steps and configuring permission control programs to manage data access to the cloud resource pool. However, since this method can only control the access address, it cannot control the data in a timely manner when abnormal data exists, resulting in poor intrusion prevention effectiveness for cloud resource pools. Summary of the Invention

[0004] Therefore, it is necessary to provide a method, apparatus, computer equipment, computer-readable storage medium, and computer program product for intercepting abnormal data in a cloud resource pool, addressing the aforementioned technical issues.

[0005] Firstly, this application provides a method for intercepting abnormal data in a cloud resource pool, including:

[0006] Obtain the current network data stream of the cloud resource pool, and perform data splitting processing on the network data stream to obtain sub-data groups corresponding to multiple security cores;

[0007] Based on the sub-data groups corresponding to each security core, a clustering algorithm is used to identify each local cluster center corresponding to each security core, and based on the local cluster centers corresponding to each security core, a center index optimization algorithm is used to select each optimal local cluster center corresponding to each security core.

[0008] Using the particle swarm optimization algorithm, each target cluster center of the current network data stream is identified among the optimal local cluster centers. Based on each target cluster center, abnormal data information in each sub-data group is filtered as suspected intrusion data information of the network data stream.

[0009] Optionally, the step of splitting the network data stream to obtain multiple sub-data groups corresponding to security kernels includes:

[0010] The network data stream is split to obtain data information for each session type, and the processing type of each security core is collected.

[0011] Based on the processing type of each security core and the session type of each data information, the database is queried to find the session type corresponding to each processing type. Based on the session type corresponding to each processing type, the data information of each session type is grouped and processed to obtain the sub-data group corresponding to the security core to which each processing type belongs.

[0012] Optionally, the step of identifying local cluster centers corresponding to each security core based on the sub-data groups corresponding to each security core using a clustering algorithm includes:

[0013] For each security core, feature extraction processing is performed on each data information in the sub-data group corresponding to the security core to obtain the key data features of each data information;

[0014] Based on the key data features of each of the data information, a clustering algorithm is used to perform data clustering processing on each of the data information to obtain each clustered data group;

[0015] Extract the central data information from each cluster data group, and use it as the local cluster center corresponding to the security kernel.

[0016] Optionally, the step of selecting the optimal local cluster centers for each security core based on the local cluster centers corresponding to each security core using a center index optimization algorithm includes:

[0017] For each security core, based on the key data features of each data information in each clustered data group corresponding to the security core, the distance value between each data information in each clustered data group is calculated using a feature distance algorithm. For each clustered data group, based on the distance value between each data information in the clustered data group, the local density value of each data information is calculated using a local density algorithm.

[0018] Based on the local density value of each data information, the high-density data information corresponding to each data information is filtered in each data information, and based on each data information and the high-density data information corresponding to each data information, the nearest distance value between each data information and the high-density data information corresponding to each data information is calculated through a distance optimization algorithm.

[0019] Based on each data information, the nearest distance value between each high-density data information corresponding to each data information, and the local density value of each data information, the central index value of each data information is calculated through the central index algorithm.

[0020] In each data set, the data set with the largest centrality index value is selected as the optimal centrality data set for the clustered data set, and the optimal centrality data set for each clustered data set is selected as the optimal local cluster center corresponding to the security kernel.

[0021] Optionally, identifying the target cluster centers of the current network data stream among the optimal local cluster centers using the particle swarm optimization algorithm includes:

[0022] Obtain the target number of cluster centers of the cloud resource pool and the objective function of the particle swarm optimization algorithm, and for each security core, filter the target centers from the optimal local cluster centers of the security core;

[0023] Based on the data information of the target center, the target function value corresponding to the target center is calculated using the target function. Based on the target function value and the target center corresponding to the target function value, the target function is adjusted to obtain a new target function.

[0024] Re-select new target centers from the optimal local cluster centers that were not selected as target centers, replace the original target centers with the new target centers, replace the original target functions with the new target functions, and return to the step of executing the data information based on the target centers and calculating the target function value corresponding to the target centers through the target functions, until the target function value corresponding to each optimal local cluster center is obtained;

[0025] Based on the number of security cores and the objective function value corresponding to each optimal local cluster center of each security core, the optimal local cluster centers corresponding to the objective function value of the target number of cluster centers are selected in descending order of objective function value and used as the target cluster centers of the current network data stream.

[0026] Optionally, the step of filtering out abnormal data information in each sub-data group based on each of the target cluster centers includes:

[0027] Based on the data information in each sub-data group of each security core and each target clustering center, a clustering algorithm is used to perform clustering processing on each sub-data group to obtain the discrete data information corresponding to each security core.

[0028] The discrete data information corresponding to each security core is used as the abnormal data information of the sub-data group corresponding to each security core, and the abnormal data information corresponding to all security cores is used as the intrusion suspicion data information of the network data stream.

[0029] Secondly, this application also provides an abnormal data interception device for a cloud resource pool, comprising:

[0030] The acquisition module is used to acquire the current network data stream of the cloud resource pool, and to split the network data stream to obtain sub-data groups corresponding to multiple security cores;

[0031] The optimization module is used to identify each local cluster center corresponding to each security core based on the sub-data group corresponding to each security core through a clustering algorithm, and to select each optimal local cluster center corresponding to each security core based on the local cluster center corresponding to each security core through a center index optimization algorithm.

[0032] The filtering module is used to identify each target cluster center of the current network data stream among the optimal local cluster centers using the particle swarm optimization algorithm, and to filter abnormal data information in each sub-data group based on each target cluster center as suspected intrusion data information of the network data stream.

[0033] Optionally, the acquisition module is specifically used for:

[0034] The network data stream is split to obtain data information for each session type, and the processing type of each security core is collected.

[0035] Based on the processing type of each security core and the session type of each data information, the database is queried to find the session type corresponding to each processing type. Based on the session type corresponding to each processing type, the data information of each session type is grouped and processed to obtain the sub-data group corresponding to the security core to which each processing type belongs.

[0036] Optionally, the optimization module is specifically used for:

[0037] For each security core, feature extraction processing is performed on each data information in the sub-data group corresponding to the security core to obtain the key data features of each data information;

[0038] Based on the key data features of each of the data information, a clustering algorithm is used to perform data clustering processing on each of the data information to obtain each clustered data group;

[0039] Extract the central data information from each cluster data group, and use it as the local cluster center corresponding to the security kernel.

[0040] Optionally, the optimization module is specifically used for:

[0041] For each security core, based on the key data features of each data information in each clustered data group corresponding to the security core, the distance value between each data information in each clustered data group is calculated using a feature distance algorithm. For each clustered data group, based on the distance value between each data information in the clustered data group, the local density value of each data information is calculated using a local density algorithm.

[0042] Based on the local density value of each data information, the high-density data information corresponding to each data information is filtered in each data information, and based on each data information and the high-density data information corresponding to each data information, the nearest distance value between each data information and the high-density data information corresponding to each data information is calculated through a distance optimization algorithm.

[0043] Based on each data information, the nearest distance value between each high-density data information corresponding to each data information, and the local density value of each data information, the central index value of each data information is calculated through the central index algorithm.

[0044] In each data set, the data set with the largest centrality index value is selected as the optimal centrality data set for the clustered data set, and the optimal centrality data set for each clustered data set is selected as the optimal local cluster center corresponding to the security kernel.

[0045] Optionally, the filtering module is specifically used for:

[0046] Obtain the target number of cluster centers of the cloud resource pool and the objective function of the particle swarm optimization algorithm, and for each security core, filter the target centers from the optimal local cluster centers of the security core;

[0047] Based on the data information of the target center, the target function value corresponding to the target center is calculated using the target function. Based on the target function value and the target center corresponding to the target function value, the target function is adjusted to obtain a new target function.

[0048] Re-select new target centers from the optimal local cluster centers that were not selected as target centers, replace the original target centers with the new target centers, replace the original target functions with the new target functions, and return to the step of executing the data information based on the target centers and calculating the target function value corresponding to the target centers through the target functions, until the target function value corresponding to each optimal local cluster center is obtained;

[0049] Based on the number of security cores and the objective function value corresponding to each optimal local cluster center of each security core, the optimal local cluster centers corresponding to the objective function value of the target number of cluster centers are selected in descending order of objective function value and used as the target cluster centers of the current network data stream.

[0050] Optionally, the filtering module is specifically used for:

[0051] Based on the data information in each sub-data group of each security core and each target clustering center, a clustering algorithm is used to perform clustering processing on each sub-data group to obtain the discrete data information corresponding to each security core.

[0052] The discrete data information corresponding to each security core is used as the abnormal data information of the sub-data group corresponding to each security core, and the abnormal data information corresponding to all security cores is used as the intrusion suspicion data information of the network data stream.

[0053] Thirdly, this application provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps of the method described in any one of the first aspects.

[0054] Fourthly, this application provides a computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the steps of the method described in any one of the first aspects.

[0055] Fifthly, this application provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the steps of the method described in any one of the first aspects.

[0056] The aforementioned method, apparatus, and computer equipment for intercepting abnormal data in a cloud resource pool acquire the current network data stream of the cloud resource pool and perform data splitting processing on the network data stream to obtain sub-data groups corresponding to multiple security cores. Based on the sub-data groups corresponding to each security core, a clustering algorithm is used to identify the local cluster centers corresponding to each security core. Based on the local cluster centers corresponding to each security core, a centrality index optimization algorithm is used to select the optimal local cluster centers corresponding to each security core. A particle swarm optimization algorithm is used to identify the target cluster centers of the current network data stream among the optimal local cluster centers. Based on the target cluster centers, abnormal data information in each sub-data group is selected as intrusion-suspected data information of the network data stream. This solution splits the network data stream into sub-data groups processed by each security core, thereby identifying intrusion-suspected data information by data stream. Each security core processes only a portion of the local data stream, and the security cores compute in parallel, thereby reducing the time required to identify intrusion-suspected data information, lowering the overall computational complexity, and improving the efficiency of identifying intrusion-suspected data information. Then, when identifying suspected intrusion data, this solution, based on the clustering algorithm, uses a centrality index optimization algorithm to first select the optimal local cluster centers calculated by each security core. Next, a particle swarm optimization algorithm is used to select the target cluster center from among these optimal local cluster centers. This avoids the problem of low accuracy in cluster centers generated by individual security cores, thereby comprehensively improving the accuracy of the selected suspected intrusion data. Finally, staff can use the selected suspected intrusion data for precise data interception, effectively improving the intrusion prevention effect on the cloud resource pool. Attached Figure Description

[0057] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0058] Figure 1 This is a system architecture diagram of an abnormal data interception system for a cloud resource pool in one embodiment;

[0059] Figure 2 This is a flowchart illustrating an abnormal data interception method for a cloud resource pool in one embodiment.

[0060] Figure 3 This is a comparison chart of the computational effects of an abnormal data interception method for cloud resource pools in one embodiment;

[0061] Figure 4This is a flowchart illustrating an example of abnormal data interception in a cloud resource pool in one embodiment;

[0062] Figure 5 This is a structural block diagram of an abnormal data interception device for a cloud resource pool in one embodiment;

[0063] Figure 6 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0064] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0065] The abnormal data interception method for cloud resource pools provided in this application embodiment can be applied to, for example... Figure 1 The example illustrates the application environment of an abnormal data interception system for a cloud resource pool. This system comprises a forwarding core and multiple security cores. Each security core includes a flow module, an intrusion prevention module, and a log analysis module. The flow module receives data from each forwarding core, the log analysis module performs cluster analysis on the data from each security core, and the intrusion prevention module identifies suspected intrusion data within each data segment. The forwarding core breaks down the network data stream into sub-data groups processed by each security core. This abnormal data interception method for the resource pool can be applied to terminals, servers, and systems involving both terminals and servers, achieved through interaction between the terminals and servers. Terminals can be, but are not limited to, various personal computers, laptops, mid-range computers, etc. By breaking down the network data stream into sub-data groups processed by each security core, the system identifies suspected intrusion data from each data stream. Each security core processes only a local portion of the data stream, and the multiple security cores perform parallel computations, thereby reducing the time required to identify suspected intrusion data, lowering the overall computational complexity, and improving the efficiency of identifying suspected intrusion data. Then, when identifying suspected intrusion data, this solution, based on the clustering algorithm, uses a centrality index optimization algorithm to first select the optimal local cluster centers calculated by each security core. Next, a particle swarm optimization algorithm is used to select the target cluster center from among these optimal local cluster centers. This avoids the problem of low accuracy in cluster centers generated by individual security cores, thereby comprehensively improving the accuracy of the selected suspected intrusion data. Finally, staff can use the selected suspected intrusion data for precise data interception, effectively improving the intrusion prevention effect on the cloud resource pool.

[0066] In one exemplary embodiment, such as Figure 2As shown, a method for intercepting abnormal data in a cloud resource pool is provided. Taking the application of this method to a terminal as an example, the method includes the following steps S201 to S203.

[0067] in:

[0068] Step S201: Obtain the current network data stream of the cloud resource pool, and perform data splitting processing on the network data stream to obtain sub-data groups corresponding to multiple security cores.

[0069] In this embodiment, the terminal obtains the network data stream to be input into the cloud resource pool from the network interface card (NIC) of the cloud resource pool via a forwarding core. The forwarding core then performs data splitting on this network data stream to obtain sub-data groups corresponding to each security core. Each security core can process data information of one session type, while the network data stream includes data information of various session types. The session type is used to characterize the data flow of different session characteristics. Processing by security cores not only ensures that the data stream of a specific session can be processed on a specific security core but also improves the processing efficiency of the network data stream. Then, the terminal performs data splitting on the network data stream to obtain multiple sub-data groups corresponding to multiple security cores. Each sub-data group corresponding to a security core represents the session type corresponding to the processing type of the session characteristics that the security core can process. This determination process will be explained in detail later.

[0070] Step S202: Based on the sub-data groups corresponding to each security core, a clustering algorithm is used to identify the local cluster centers corresponding to each security core. Based on the local cluster centers corresponding to each security core, a centrality index optimization algorithm is used to select the optimal local cluster centers corresponding to each security core.

[0071] In this embodiment, the terminal, based on the sub-data groups corresponding to each security core, performs clustering processing on the sub-data groups of each security core using a clustering algorithm, thereby generating local cluster centers for each security core. Then, based on the local cluster centers corresponding to each security core, the terminal re-selects the local cluster centers corresponding to each security core using a centrality index optimization algorithm to obtain the optimal local cluster centers for each security core. The clustering algorithm used is the K-means clustering algorithm. The specific process of identifying local cluster centers and optimal local cluster centers will be explained in detail later.

[0072] Step S203: Using the particle swarm optimization algorithm, identify the target cluster centers of the current network data stream among the optimal local cluster centers, and based on each target cluster center, filter the abnormal data information in each sub-data group as suspected intrusion data information of the network data stream.

[0073] In this embodiment, the terminal uses a particle swarm optimization (PSO) algorithm to identify target cluster centers for the current network data stream among the optimal local cluster centers. Based on these target cluster centers, it filters abnormal data information in each sub-data group as suspected intrusion data information for the network data stream. The PSO algorithm used is Particle Swarm Optimization (PSO). The specific identification process will be explained in detail later.

[0074] Based on the above scheme, by splitting the network data stream into sub-data groups processed by each security core, intrusion-suspect data information is identified separately for each data stream. Each security core processes only a local portion of the data stream, and the security cores compute in parallel, thereby reducing the time required to identify intrusion-suspect data information, lowering the overall computational complexity, and improving the efficiency of intrusion-suspect data information identification. Then, when identifying intrusion-suspect data information, this scheme, based on the clustering algorithm, uses a centrality index optimization algorithm to first select the optimal local cluster centers calculated by each security core. Then, a particle swarm optimization algorithm is used to select the target cluster center from among these optimal local cluster centers, avoiding the problem of low accuracy in the cluster centers generated by each security core, thus comprehensively improving the accuracy of the selected intrusion-suspect data information. Finally, staff can use the selected intrusion-suspect data information for precise data interception, effectively improving the intrusion prevention effect on the cloud resource pool.

[0075] Optionally, the network data stream is split into multiple sub-data groups corresponding to multiple security cores. This includes: splitting the network data stream to obtain data information for each session type and collecting the processing type of each security core; based on the processing type of each security core and the session type of each data information, querying the session type corresponding to each processing type in the database, and grouping the data information of each session type according to the session type corresponding to each processing type to obtain the sub-data group corresponding to the security core to which each processing type belongs.

[0076] In this embodiment, the terminal performs data splitting processing on the network data stream to obtain data information for each session type and collects the processing type of each security core. The processing type of each security core is the session feature that each security core can process, and each session type is the session feature to which each data information belongs. Then, the terminal filters the data information corresponding to the session features that a security core can process, as the sub-data group corresponding to that security core. Each session feature is a feature identifier in the interactive session information corresponding to each network data stream; this feature identifier is preset by the operator in each data information. The terminal uses this identifier to identify the session type corresponding to the processing type of each security core.

[0077] Based on the above scheme, after splitting the network data stream by session type, the security core to which each data information belongs is identified by the correspondence between the processing type of each security core and the session type, thereby determining the sub-data group corresponding to each security core and improving the identification accuracy of the sub-data group corresponding to each security core.

[0078] Optionally, based on the sub-data groups corresponding to each security core, a clustering algorithm is used to identify the local cluster centers corresponding to each security core, including: for each security core, performing feature extraction processing on each data information in the sub-data group corresponding to the security core to obtain the key data features of each data information; based on the key data features of each data information, performing data clustering processing on each data information using a clustering algorithm to obtain each clustered data group; and extracting the central data information in each clustered data group as the local cluster centers corresponding to each security core.

[0079] In this embodiment, for each security core, the terminal identifies the information features of each data information in the sub-data group corresponding to the security core, and uses each information feature as the key data feature of each data information. The information features of each data information include, but are not limited to, data features such as network request data of the system, port, network segment, and host corresponding to that data information.

[0080] Then, based on the key data features of each data item, the terminal uses a clustering algorithm to perform data clustering processing on each data item, resulting in clustered data groups. The clustering process is as follows:

[0081] 1. Initialization: The terminal generates K initial cluster centers. These centers can be random points in the subgroups of data, or an initialization method such as K-means++ can be used to ensure better selection of initial centroids.

[0082] 2. Assign data to the nearest cluster centers: For each data point in a subgroup, calculate the distance between the key data features of each data point and the K cluster centers. Assign each data point to the nearest cluster center, forming K clusters.

[0083] 3. Recalculate cluster centers: For each cluster, calculate the average of the key data features of all data information within the cluster, and set this average as the new cluster center.

[0084] 4. Iterative optimization: Repeat steps 2 and 3 until the position of the cluster center no longer changes significantly, or the preset number of iterations is reached.

[0085] Finally, the terminal uses the cluster centers from the last iteration as the central data information for each cluster data group, and then uses the central data information in each cluster data group as the local cluster centers corresponding to the security kernel.

[0086] Based on the above scheme, by identifying the key data features of each data information in the sub-data group, and then identifying each local cluster center of each sub-data group, the identification efficiency and accuracy of each local cluster center are improved.

[0087] Optionally, based on the local cluster centers corresponding to each security core, the optimal local cluster centers corresponding to each security core are selected using a center index optimization algorithm. This includes: for each security core, based on the key data features of each data information in each clustered data group corresponding to the security core, calculating the distance between each data information in each clustered data group using a feature distance algorithm; and for each clustered data group, based on the distance between each data information in each clustered data group, calculating the local density value of each data information using a local density algorithm; and based on the local density value of each data information, selecting the high-density data information corresponding to each data information, and... For each data piece of information and each high-density data piece of information corresponding to each data piece of information, the nearest distance value between each data piece of information and each high-density data piece of information corresponding to each data piece of information is calculated using a distance optimization algorithm. Based on each data piece of information, the nearest distance value between each data piece of information and each high-density data piece of information corresponding to each data piece of information, and the local density value of each data piece of information, the centrality index value of each data piece of information is calculated using a centrality index algorithm. In each data piece of information, the data piece of information with the largest centrality index value is selected as the optimal central data piece of the cluster data group, and the optimal central data piece of each cluster data group is used as the optimal local cluster center corresponding to the safety kernel.

[0088] In this embodiment, firstly, the center of each category must be the point with the highest local density in that category, where local density is represented by ρ. i The degree of local clustering of the i-th data point is represented by δ; secondly, the cluster center maintains a relatively large distance from points with higher local density, and this distance is denoted by δ. i These two parameters effectively describe the location of a data point within the dataset. Specifically, we can categorize the possibilities of a point into four cases based on these two parameters:

[0089] 1. If ρ at a certain point i The value is large and δ i A small value means that although the point is close to the cluster center, there are points that are closer to the cluster center and may be of the same type, so the point is not very likely to become the cluster center.

[0090] 2. If ρ at a certain point i and δ i If the values ​​are all small, it may be on the edge of its category;

[0091] 3. If ρ at a certain point i The value is small and δ i A large value indicates that the point is far from the entire dataset, so it is likely an outlier.

[0092] 4. Finally, if ρ at a certain point i and δ i If the values ​​are all relatively large, then it is highly likely to be a cluster center. To quantify the probability that each point will become a cluster center, a new metric is introduced here—the Centre Score. This index is defined based on the above characteristics and is used to measure the potential of each point to be a cluster center.

[0093] After data cleaning, feature extraction, and data encoding, the terminal encodes each stream into data information: X L = [x1,x2,…,x L ], where x i =[x 1i ,x 2i ,…,x Ni Let T be a column vector transformed from the i-th data information, and L be the total number of data information. Then, for each security core, the terminal calculates the distance between each data information in each cluster based on the key data features of each data information in each cluster corresponding to the security core, using a feature distance algorithm. The feature distance algorithm is: the Euclidean distance between two data information:

[0094] d ij =||x i -x j ||2 (1)

[0095] In the above formula, the Euclidean distance between the two data points is d. ij ,‖X i -X j ‖2 represents the 2-norm operator. Then, the terminal controls the neighborhood range of the cluster centers by setting a threshold, typically using a Gaussian kernel function for adaptive adjustment. Therefore, for each clustered data group, based on the distance values ​​between data points within the cluster, a local density algorithm is used to calculate the local density value of each data point. This local density value is determined by ρ... i This indicates that the calculation formula for the local density algorithm is:

[0096]

[0097] Next, based on the local density value of each data piece of information, the terminal filters out the high-density data pieces corresponding to each data piece of information. Then, based on each data piece of information and its corresponding high-density data pieces, a distance optimization algorithm is used to calculate the nearest distance between each data piece of information and its corresponding high-density data pieces. This distance optimization algorithm is as follows:

[0098]

[0099] Finally, based on each data piece of information, the nearest distance value between each high-density data piece of information corresponding to each data piece of information, and the local density value of each data piece of information, the terminal calculates the center index value of each data piece of information using the center index algorithm. The calculation formula for this center index algorithm is as follows:

[0100] CSi = ρ i * δ i (4)

[0101] In summary, the pseudocode for the SCA (Society Center Index) algorithm is shown below:

[0102] 1. Input: X = [x1, x2, ..., xL].

[0103] 2. Calculate the distance d between each pair of data points according to formula (1). ij .

[0104] 3. Calculate the local density ρ of each data information according to equation (2). i .

[0105] 4. Calculate δ for each data information based on equation (3). i .

[0106] 5. Calculate the central index CSi of each data information according to formula (4).

[0107] 6. Sort the data information from largest to smallest according to CSi, and select the first n as needed.

[0108] In each data set, the terminal selects the data set with the largest centrality index value as the optimal centrality data set for the clustered data set, and uses the optimal centrality data set of each clustered data set as the optimal local cluster center corresponding to the security kernel.

[0109] Based on the above scheme, by combining the center index optimization algorithm, the cluster centers calculated for each safe kernel are optimized, thereby improving the accuracy of the optimal local cluster centers corresponding to each safe kernel.

[0110] Optionally, using the particle swarm optimization algorithm, target cluster centers for the current network data stream are identified among the optimal local cluster centers. This includes: obtaining the number of target cluster centers in the cloud resource pool and the objective function of the particle swarm optimization algorithm; for each security core, selecting target centers from the optimal local cluster centers of the security core; calculating the objective function value corresponding to the target center based on the target center's data information; adjusting the objective function based on the objective function value and the target center corresponding to the objective function value to obtain a new objective function; re-selecting new target centers from the optimal local cluster centers that were not selected as target centers, replacing the original target centers with new target centers and replacing the original objective function with new objective functions; returning to the step of calculating the objective function value corresponding to the target center based on the target center's data information and the objective function, until the objective function value corresponding to each optimal local cluster center is obtained; based on the number of security cores and the objective function values ​​corresponding to the optimal local cluster centers of each security core, selecting the optimal local cluster centers corresponding to the objective function values ​​of the target cluster center count in descending order of objective function values ​​as the target cluster centers for the current network data stream.

[0111] In this embodiment, the terminal obtains the target number of cluster centers in the cloud resource pool and the objective function of the particle swarm optimization algorithm. For each security core, it then filters target centers from the optimal local cluster centers within that security core. Since the data stream has been distributed to different security cores, the terminal treats the sub-data groups of each security core as a subspace. Then, a center index optimization algorithm is used to select cluster centers for each subspace. Only the top n optimal cluster centers are selected for each subspace, resulting in n*N cluster centers selected from N subspaces. Finally, the particle swarm optimization algorithm is used to globally optimize and find N cluster centers as a combination, i.e., the optimal solution. The optimization logic of the particle swarm optimization algorithm is as follows:

[0112] 1. Initialization:

[0113] The terminal randomly generates a set of particles in the solution space, each particle having a random position and velocity.

[0114] • The terminal sets the particle size, which is the number of particles in the particle swarm.

[0115] • Initialize the individual optimal position pbest and the global optimal position gbest of the particle at the terminal.

[0116] 2. Evaluation:

[0117] The terminal calculates the fitness value for each particle, which is typically evaluated using the objective function to be optimized.

[0118] • Terminal updates individual and global optimal solutions:

[0119] If the current particle's fitness is better than its historical best fitness, then update the particle's individual best position pbest.

[0120] If the current particle's fitness is better than the global best fitness of the population, then update the global best position gbest.

[0121] 3. Update speed and location:

[0122] The terminal updates the particle's velocity and position based on the individual optimal position pbest, the global optimal position gbest, and the particle's current velocity and position: vi = vi + C1 × rand() × (pbest - xi) + C2 × rand() × (gbest - xi); xi = xi + vi; where rand() is a random number between 0 and 1, and C1 and C2 are learning factors, usually C1 = C2 = 2;

[0123] 4. Termination of inspection:

[0124] The terminal checks whether the preset maximum number of iterations has been reached or other termination conditions have been met. If so, the algorithm stops; otherwise, it returns to step 2 to continue iterating.

[0125] The optimization logic for each cluster center involved in this scheme is adaptively adjusted as follows:

[0126] 1. Given N subspaces, select n cluster centers from each subspace as candidates;

[0127] 2. Initialize the particle swarm algorithm:

[0128] • Define the objective function;

[0129] • Determine the particle dimension as N, which is the number of cluster centers for the optimal combination;

[0130] 3. Apply the particle swarm optimization algorithm and perform the following operations on each subspace:

[0131] • Select one of the cluster centers and calculate the objective function value;

[0132] • An algorithm for updating particles based on the results;

[0133] 4. Finally, find the global optimal solution for the entire population;

[0134] The first and second steps are as follows: the terminal calculates the target function value corresponding to the target center based on the data information of the target center, and adjusts the target function based on the target function value and the target center corresponding to the target function value to obtain a new target function.

[0135] Then, the second step is as follows: the terminal re-selects new target centers from the optimal local cluster centers that were not selected as target centers, replaces the target centers with new target centers, replaces the target functions with new target functions, and returns the data information based on the target centers. The steps of calculating the target function value corresponding to the target centers are repeated until the target function value corresponding to each optimal local cluster center is obtained.

[0136] Finally, the fourth step corresponds to the terminal selecting the optimal local cluster center corresponding to the objective function value of the target cluster center number based on the number of security cores and the objective function value corresponding to each optimal local cluster center of each security core, in descending order of objective function value, as the target cluster center of the current network data stream.

[0137] Based on the above scheme, by leveraging the optimization characteristics of the particle swarm optimization algorithm, the target cluster center of the current network data stream is selected from each cluster center, thereby improving the accuracy of the target cluster center selection.

[0138] Optionally, based on each target cluster center, abnormal data information in each sub-data group is filtered, including: based on the data information in each sub-data group of each security core and each target cluster center, each sub-data group is clustered using a clustering algorithm to obtain discrete data information corresponding to each security core; the discrete data information corresponding to each security core is used as the abnormal data information of the sub-data group corresponding to each security core, and the abnormal data information corresponding to all security cores is used as the intrusion suspicion data information of the network data stream.

[0139] In this embodiment, the terminal, based on the data information in each sub-data group of each security core and each target cluster center, performs clustering processing on each sub-data group using a clustering algorithm to obtain discrete data information corresponding to each security core. Then, the terminal uses the discrete data information corresponding to each security core as abnormal data information for the sub-data group corresponding to each security core, and uses the abnormal data information corresponding to all security cores as suspected intrusion data information for the network data stream. This abnormal data information is sent to the staff client, guiding staff to manually judge the abnormal data information for suspected intrusion, avoiding false interception of data information due to misidentification. This improves the accuracy of intrusion prevention and intrusion judgment based on abnormal data information.

[0140] Based on the above scheme, the accuracy of filtering discrete data information is improved by optimizing the target cluster centers.

[0141] In one embodiment, for example, with authorization, the terminal collects 7 days of data traffic from the enterprise cloud resource pool's firewall. The terminal then performs preliminary work such as data cleaning, sampling, feature extraction, and encoding to form a dataset. The firewall runs on a bare-metal device with 16 cores and 32GB of RAM. One core is for forwarding, and the rest are security cores.

[0142] Then, the terminal can select appropriate evaluation metrics to verify the effectiveness of the algorithm. The evaluation metric used in this chapter is the confusion matrix, as shown in Table 1. The confusion matrix will evaluate the algorithm proposed in this paper from the following metrics: accuracy, recall, precision, and F1 score.

[0143] Table 1: Confusion Matrix

[0144] state Judged as normal judged as an attack Normal traffic TN FN Intrusion traffic FP TP

[0145] Accuracy reflects the classifier's ability to judge samples.

[0146] AC=(TP+TN) / (TP+FN+FP+TN) (5)

[0147] Recall reflects the proportion of correct attack samples among all attack samples:

[0148] Recall = TP / (TP + FN) (6)

[0149] Precision reflects the proportion of correctly identified attack samples out of all samples predicted as attacks.

[0150] Precision = TP / (TP + FP) (7)

[0151] The F1 score reflects the overall performance as well as the recall and precision metrics.

[0152] F1=2TP / (2TP+FP+FN) (8)

[0153] Then, after fine-tuning the model's parameters multiple times using the entire training set, the terminal randomly split 20% of the data on the test set to conduct 5 sets of experiments, with each set undergoing 30 rounds of testing. The experimental results are shown in Table 2:

[0154] Table 2: Scores of each indicator for different groups

[0155]

[0156]

[0157] The results show that the proposed algorithm achieves an average accuracy of 96% under the current parameters, with other indicators also performing relatively well. Through cross-validation and repeated trials, the algorithm model consistently achieved stable results across multiple rounds of testing with different experimental data, demonstrating its robustness. This is significant because, in real-world environments with massive and complex traffic volumes, and with increasingly complex and variable input data, the model's ability to maintain stable operation is crucial, especially for intrusion detection systems.

[0158] The time aspect analysis is as follows:

[0159] like Figure 3 As shown, the method (Current Algorithm) involved in this scheme is about 3 times faster than the traditional method (Traditional Algorithm), which is a significant performance improvement.

[0160] This application also provides an example of abnormal data interception for cloud resource pools, such as... Figure 4 As shown, the specific processing procedure includes the following steps:

[0161] Step S401: Obtain the current network data stream of the cloud resource pool.

[0162] Step S402: Perform data splitting processing on the network data stream to obtain data information for each session type, and collect the processing type of each security core.

[0163] Step S403: Based on the processing type of each security core and the session type of each data information, query the session type corresponding to each processing type in the database, and based on the session type corresponding to each processing type, group the data information of each session type to obtain the sub-data group corresponding to the security core to which each processing type belongs.

[0164] Step S404: For each security core, perform feature extraction processing on each data information in the sub-data group corresponding to the security core to obtain the key data features of each data information.

[0165] Step S405: Based on the key data features of each data information, a clustering algorithm is used to perform data clustering processing on each data information to obtain each clustered data group.

[0166] Step S406: Extract the central data information from each cluster data group, which serves as the local cluster center corresponding to the security kernel.

[0167] Step S407: For each security core, based on the key data features of each data information in each clustered data group corresponding to the security core, the distance value between each data information in each clustered data group is calculated using the feature distance algorithm. For each clustered data group, based on the distance value between each data information in each clustered data group, the local density value of each data information is calculated using the local density algorithm.

[0168] Step S408: Based on the local density value of each data information, filter the high-density data information corresponding to each data information in each data information, and calculate the nearest distance value between each data information and the high-density data information corresponding to each data information through a distance optimization algorithm.

[0169] Step S409: Based on each data information, the nearest distance value between each high-density data information corresponding to each data information, and the local density value of each data information, calculate the center index value of each data information using the center index algorithm.

[0170] Step S410: In each data information, the data information with the largest centrality index value is selected as the optimal centrality data information of the cluster data group, and the optimal centrality data information of each cluster data group is used as the optimal local cluster center corresponding to the safety kernel.

[0171] Step S411: Obtain the target number of cluster centers for the cloud resource pool and the objective function of the particle swarm optimization algorithm, and for each security core, select the target center from the optimal local cluster centers of the security core.

[0172] Step S412: Based on the data information of the target center, calculate the target function value corresponding to the target center through the target function, and adjust the target function based on the target function value and the target center corresponding to the target function value to obtain a new target function.

[0173] Step S413: Re-select new target centers from the optimal local cluster centers that were not selected as target centers, replace the original target centers with new target centers, replace the original target function with new target functions, and return to the execution steps of data information based on the target centers and calculating the target function value corresponding to the target centers, until the target function value corresponding to each optimal local cluster center is obtained.

[0174] Step S414: Based on the number of security kernels and the objective function value corresponding to each optimal local cluster center of each security kernel, the optimal local cluster centers corresponding to the objective function value of the target cluster center number are selected in descending order of objective function value, and used as the target cluster centers of the current network data flow.

[0175] Step S415: Based on the data information in each sub-data group of each security core and each target cluster center, clustering algorithm is used to perform clustering processing on each sub-data group to obtain the discrete data information corresponding to each security core.

[0176] Step S416: The discrete data information corresponding to each security core is used as the abnormal data information of the sub-data group corresponding to each security core, and the abnormal data information corresponding to all security cores is used as the intrusion suspicion data information of the network data stream.

[0177] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0178] Based on the same inventive concept, this application also provides an abnormal data interception device for cloud resource pools to implement the abnormal data interception method for cloud resource pools described above. The solution provided by this device is similar to the solution described in the above method. Therefore, the specific limitations of one or more embodiments of the abnormal data interception device for cloud resource pools provided below can be found in the limitations of the abnormal data interception method for cloud resource pools described above, and will not be repeated here.

[0179] In one exemplary embodiment, such as Figure 5 As shown, an abnormal data interception device for a cloud resource pool is provided, comprising: an acquisition module 510, an optimization module 520, and a filtering module 530, wherein:

[0180] The acquisition module 510 is used to acquire the current network data stream of the cloud resource pool, and to perform data splitting processing on the network data stream to obtain sub-data groups corresponding to multiple security cores;

[0181] The optimization module 520 is used to identify each local cluster center corresponding to each security core based on the sub-data group corresponding to each security core through a clustering algorithm, and to select each optimal local cluster center corresponding to each security core based on the local cluster center corresponding to each security core through a center index optimization algorithm.

[0182] The filtering module 530 is used to identify each target cluster center of the current network data stream in each of the optimal local cluster centers using the particle swarm optimization algorithm, and to filter abnormal data information in each sub-data group based on each target cluster center as suspected intrusion data information of the network data stream.

[0183] Optionally, the acquisition module 510 is specifically used for:

[0184] The network data stream is split to obtain data information for each session type, and the processing type of each security core is collected.

[0185] Based on the processing type of each security core and the session type of each data information, the database is queried to find the session type corresponding to each processing type. Based on the session type corresponding to each processing type, the data information of each session type is grouped and processed to obtain the sub-data group corresponding to the security core to which each processing type belongs.

[0186] Optionally, the optimization module 520 is specifically used for:

[0187] For each security core, feature extraction processing is performed on each data information in the sub-data group corresponding to the security core to obtain the key data features of each data information;

[0188] Based on the key data features of each of the data information, a clustering algorithm is used to perform data clustering processing on each of the data information to obtain each clustered data group;

[0189] Extract the central data information from each cluster data group, and use it as the local cluster center corresponding to the security kernel.

[0190] Optionally, the optimization module 520 is specifically used for:

[0191] For each security core, based on the key data features of each data information in each clustered data group corresponding to the security core, the distance value between each data information in each clustered data group is calculated using a feature distance algorithm. For each clustered data group, based on the distance value between each data information in the clustered data group, the local density value of each data information is calculated using a local density algorithm.

[0192] Based on the local density value of each data information, the high-density data information corresponding to each data information is filtered in each data information, and based on each data information and the high-density data information corresponding to each data information, the nearest distance value between each data information and the high-density data information corresponding to each data information is calculated through a distance optimization algorithm.

[0193] Based on each data information, the nearest distance value between each high-density data information corresponding to each data information, and the local density value of each data information, the central index value of each data information is calculated through the central index algorithm;

[0194] In each data set, the data set with the largest centrality index value is selected as the optimal centrality data set for the clustered data set, and the optimal centrality data set for each clustered data set is selected as the optimal local cluster center corresponding to the security kernel.

[0195] Optionally, the filtering module 530 is specifically used for:

[0196] Obtain the target number of cluster centers of the cloud resource pool and the objective function of the particle swarm optimization algorithm, and for each security core, filter the target centers from the optimal local cluster centers of the security core;

[0197] Based on the data information of the target center, the target function value corresponding to the target center is calculated using the target function. Based on the target function value and the target center corresponding to the target function value, the target function is adjusted to obtain a new target function.

[0198] Re-select new target centers from the optimal local cluster centers that were not selected as target centers, replace the original target centers with the new target centers, replace the original target functions with the new target functions, and return to the step of executing the data information based on the target centers and calculating the target function value corresponding to the target centers through the target functions, until the target function value corresponding to each optimal local cluster center is obtained;

[0199] Based on the number of security cores and the objective function value corresponding to each optimal local cluster center of each security core, the optimal local cluster centers corresponding to the objective function value of the target number of cluster centers are selected in descending order of objective function value and used as the target cluster centers of the current network data stream.

[0200] Optionally, the filtering module 530 is specifically used for:

[0201] Based on the data information in each sub-data group of each security core and each target clustering center, a clustering algorithm is used to perform clustering processing on each sub-data group to obtain the discrete data information corresponding to each security core.

[0202] The discrete data information corresponding to each security core is used as the abnormal data information of the sub-data group corresponding to each security core, and the abnormal data information corresponding to all security cores is used as the intrusion suspicion data information of the network data stream.

[0203] Each module in the aforementioned cloud resource pool's abnormal data interception device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the computer device's memory as software, so that the processor can invoke and execute the corresponding operations of each module.

[0204] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 6 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When executed by the processor, the computer program implements a method for intercepting abnormal data in a cloud resource pool. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0205] Those skilled in the art will understand that Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0206] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program as steps of the method described in any one of the first aspects.

[0207] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, wherein the computer program, when executed by a processor, comprises the steps of the method described in any one of the first aspects.

[0208] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, comprises the steps of the method described in any one of the first aspects.

[0209] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0210] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0211] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0212] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for intercepting abnormal data in a cloud resource pool, characterized in that, The method includes: Obtain the current network data stream of the cloud resource pool, and perform data splitting processing on the network data stream to obtain sub-data groups corresponding to multiple security cores; Based on the sub-data groups corresponding to each security core, a clustering algorithm is used to identify the local cluster centers corresponding to each security core. For each security core, based on the key data features of each data information in each clustered data group corresponding to the security core, the distance value between each data information in each clustered data group is calculated using a feature distance algorithm. For each clustered data group, based on the distance value between each data information in the clustered data group, the local density value of each data information is calculated using a local density algorithm. Based on the local density value of each data information, the high-density data information corresponding to each data information is filtered in each data information, and based on each data information and the high-density data information corresponding to each data information, the nearest distance value between each data information and the high-density data information corresponding to each data information is calculated through a distance optimization algorithm. Based on each data information, the nearest distance value between each high-density data information corresponding to each data information, and the local density value of each data information, the central index value of each data information is calculated through the central index algorithm. In each data information, the data information with the largest central index value is selected as the optimal central data information of the clustered data group, and the optimal central data information of each clustered data group is used as the optimal local cluster center corresponding to the security kernel. Using the particle swarm optimization algorithm, each target cluster center of the current network data stream is identified among the optimal local cluster centers. Based on each target cluster center, abnormal data information in each sub-data group is filtered as suspected intrusion data information of the network data stream.

2. The method according to claim 1, characterized in that, The process of splitting the network data stream to obtain multiple sub-data groups corresponding to security kernels includes: The network data stream is split to obtain data information for each session type, and the processing type of each security core is collected. Based on the processing type of each security core and the session type of each data information, the database is queried to find the session type corresponding to each processing type. Based on the session type corresponding to each processing type, the data information of each session type is grouped and processed to obtain the sub-data group corresponding to the security core to which each processing type belongs.

3. The method according to claim 1, characterized in that, The step of identifying local cluster centers for each security core based on its corresponding sub-data groups using a clustering algorithm includes: For each security core, feature extraction processing is performed on each data information in the sub-data group corresponding to the security core to obtain the key data features of each data information; Based on the key data features of each of the data information, a clustering algorithm is used to perform data clustering processing on each of the data information to obtain each clustered data group; Extract the central data information from each cluster data group, and use it as the local cluster center corresponding to the security kernel.

4. The method according to claim 1, characterized in that, The step of identifying target cluster centers for the current network data stream among the optimal local cluster centers using the particle swarm optimization algorithm includes: Obtain the target number of cluster centers of the cloud resource pool and the objective function of the particle swarm optimization algorithm, and for each security core, filter the target centers from the optimal local cluster centers of the security core; Based on the data information of the target center, the target function value corresponding to the target center is calculated using the target function. Based on the target function value and the target center corresponding to the target function value, the target function is adjusted to obtain a new target function. Re-select new target centers from the optimal local cluster centers that were not selected as target centers, replace the original target centers with the new target centers, replace the original target functions with the new target functions, and return to the step of executing the data information based on the target centers and calculating the target function value corresponding to the target centers through the target functions, until the target function value corresponding to each optimal local cluster center is obtained; Based on the number of security cores and the objective function value corresponding to each optimal local cluster center of each security core, the optimal local cluster centers corresponding to the objective function value of the target number of cluster centers are selected in descending order of objective function value and used as the target cluster centers of the current network data stream.

5. The method according to claim 1, characterized in that, The step of filtering abnormal data information in each sub-data group based on each target cluster center as suspected intrusion data information of the network data stream includes: Based on the data information in each sub-data group of each security core and each target clustering center, a clustering algorithm is used to perform clustering processing on each sub-data group to obtain the discrete data information corresponding to each security core. The discrete data information corresponding to each security core is used as the abnormal data information of the sub-data group corresponding to each security core, and the abnormal data information corresponding to all security cores is used as the intrusion suspicion data information of the network data stream.

6. An abnormal data interception device for a cloud resource pool, characterized in that, The device includes: The acquisition module is used to acquire the current network data stream of the cloud resource pool, and to split the network data stream to obtain sub-data groups corresponding to multiple security cores; The optimization module is used to identify local cluster centers corresponding to each security core based on the sub-data groups corresponding to each security core using a clustering algorithm; for each security core, based on the key data features of each data information in each clustered data group corresponding to the security core, calculate the distance value between each data information in each clustered data group using a feature distance algorithm; and for each clustered data group, based on the distance value between each data information in each clustered data group, calculate the local density value of each data information using a local density algorithm; based on the local density value of each data information, filter out each high-density data information corresponding to each data information, and based on each... Each data piece of information, and each high-density data piece of information corresponding to each data piece of information, is used to calculate the nearest distance value between each data piece of information and each high-density data piece of information corresponding to each data piece of information through a distance optimization algorithm. Based on each data piece of information, the nearest distance value between each data piece of information and each high-density data piece of information corresponding to each data piece of information, and the local density value of each data piece of information, the center index value of each data piece of information is calculated through a center index algorithm. In each data piece of information, the data piece of information with the largest center index value is selected as the optimal center data piece of the clustered data group, and the optimal center data piece of each clustered data group is used as the optimal local cluster center corresponding to the security kernel. The filtering module is used to identify each target cluster center of the current network data stream among the optimal local cluster centers using the particle swarm optimization algorithm, and to filter abnormal data information in each sub-data group based on each target cluster center as suspected intrusion data information of the network data stream.

7. The apparatus according to claim 6, characterized in that, The acquisition module is specifically used for: The network data stream is split to obtain data information for each session type, and the processing type of each security core is collected. Based on the processing type of each security core and the session type of each data information, the database is queried to find the session type corresponding to each processing type. Based on the session type corresponding to each processing type, the data information of each session type is grouped and processed to obtain the sub-data group corresponding to the security core to which each processing type belongs.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images