Cloud security threat detection methods, devices, equipment and storage media

Abstract

This application provides a cloud security threat detection method, apparatus, device, and storage medium, comprising: preprocessing a pre-acquired cloud security threat dataset to obtain a first target cloud security threat dataset; obtaining cloud security threat detection coefficients corresponding to each target feature; removing a first feature from the target features based on the cloud security threat detection coefficients to obtain a second feature; removing a third feature from the second feature based on a pre-set preset value and a pre-constructed feature selection function to obtain a second target cloud security threat dataset; and outputting cloud security threat detection results. The dataset in this embodiment improves the accuracy and efficiency of cloud security threat detection by simplifying features, resulting in more reliable and accurate detection results.

Description

Technical Field

[0001] This application relates to the field of cloud security technology, and in particular to a cloud security threat detection method, apparatus, device, and storage medium. Background Technology

[0002] With the rapid development of the internet, various economic and social activities have gradually shifted online, and the wave of enterprise digital transformation is intensifying. Cloud computing, as a crucial infrastructure for enterprise digital transformation, has received significant attention from all sectors and has been widely applied in government, transportation, healthcare, finance, and other fields. As industries increasingly migrate to the cloud, cloud security faces greater challenges. Cloud-based business systems are increasingly vulnerable to malicious attacks. With the upgrading of malicious attack techniques, attack methods are becoming more diverse. Enterprises need to accurately identify and appropriately handle these complex attack methods, requiring them to simultaneously upgrade their threat detection technologies.

[0003] In related technologies, network intrusion data is collected, features are extracted to construct a training set, the amount of data of types with small data volume is increased, and then an ensemble learning method is used to combine multiple learners to predict the data category to which the detected data belongs.

[0004] However, the above method does not filter the extracted features. Therefore, the raw data obtained has many feature dimensions and poor data expressive power, which can easily lead to the curse of dimensionality. This causes the computational cost of the algorithm to increase exponentially with the increase of data dimensionality. Using such raw data for training will seriously affect the accuracy of the detection results. Summary of the Invention

[0005] This application provides a cloud security threat detection method, apparatus, device, and storage medium.

[0006] In a first aspect, embodiments of this application provide a cloud security threat detection method, the method comprising:

[0007] The pre-acquired cloud security threat dataset is preprocessed to obtain a first target cloud security threat dataset, which includes target features;

[0008] Obtain the cloud security threat detection coefficients corresponding to each of the target features;

[0009] The second feature is obtained by removing the first feature from the target features based on the cloud security threat detection coefficient;

[0010] The third feature in the second feature is removed based on the preset value and the pre-built feature selection function to obtain the second target cloud security threat dataset.

[0011] Output the cloud security threat detection results corresponding to the second target cloud security threat dataset.

[0012] Optionally, the preprocessing of the pre-acquired cloud security threat dataset to obtain the first target cloud security threat dataset includes:

[0013] Obtain cloud security threat datasets;

[0014] Determine whether there are missing values, and / or outliers in the features of the cloud security threat dataset;

[0015] If the features in the cloud security threat dataset have missing values, then the missing values ​​are filled with fixed values ​​or deleted; and / or,

[0016] If there are outliers in the features of the cloud security threat dataset, then the outliers are padded with the mean or deleted to obtain the first target cloud security threat dataset.

[0017] Optionally, obtaining the cloud security threat detection coefficients corresponding to each of the target features includes:

[0018] The target features are input into the Pearson model to calculate the cloud security threat detection coefficient corresponding to each target feature.

[0019] Optionally, the step of removing the first feature from the target features based on the cloud security threat detection coefficient to obtain the second feature includes:

[0020] The cloud security threat detection coefficients are sorted and a bar chart showing the correlation between feature values ​​and cloud security threat detection is output.

[0021] Based on the histogram, the first feature to be removed from the target features is determined, and the second feature is obtained.

[0022] Optionally, the step of removing the third feature from the second feature based on a preset value and a pre-constructed feature selection function to obtain the second target cloud security threat dataset includes:

[0023] The feature selection function is constructed by minimizing the sum of squared residuals, adding a pre-defined minimum absolute shrinkage and a penalty term to the selection operator algorithm;

[0024] The second target cloud security threat dataset is obtained by removing the third feature from the second feature based on the preset values ​​and the pre-built feature selection function.

[0025] Optionally, the output of the cloud security threat detection results corresponding to the second target cloud security threat dataset includes:

[0026] The second target cloud security threat dataset is input into the enhancement model, and the cloud security threat detection results corresponding to at least one algorithm integrated in the enhancement model are output.

[0027] Optionally, the step of inputting the second target cloud security threat dataset into the enhancement model and outputting the cloud security threat detection results corresponding to at least one algorithm integrated in the enhancement model includes:

[0028] The second target cloud security threat dataset is input into the enhancement model, and the subject operating characteristic curves and area under the curves corresponding to each algorithm integrated in the enhancement model are output.

[0029] The target algorithm in the improvement model is determined based on the subject operating characteristic curve and the area under the curve.

[0030] The target algorithm outputs the cloud security threat detection results corresponding to the second target cloud security threat dataset.

[0031] Secondly, embodiments of this application provide a cloud security threat detection device, the device comprising:

[0032] The preprocessing module is used to preprocess the pre-acquired cloud security threat dataset to obtain a first target cloud security threat dataset, which includes target features;

[0033] The acquisition module is used to acquire the cloud security threat detection coefficients corresponding to each of the target features;

[0034] The first elimination module is used to eliminate the first feature from the target features based on the cloud security threat detection coefficient to obtain the second feature;

[0035] The second elimination module is used to eliminate the third feature in the second feature according to the preset value and the pre-built feature selection function to obtain the second target cloud security threat dataset.

[0036] The output module is used to output the cloud security threat detection results corresponding to the second target cloud security threat dataset.

[0037] Optionally, the preprocessing module includes:

[0038] The first preprocessing submodule is used to acquire a cloud security threat dataset;

[0039] The second preprocessing submodule is used to determine whether there are missing values ​​and / or outliers in the features of the cloud security threat dataset;

[0040] The third preprocessing submodule is used to fill in or delete missing values ​​for the missing features in the cloud security threat dataset if such values ​​exist; and / or,

[0041] The fourth preprocessing submodule is used to fill or delete outliers in the cloud security threat dataset if there are outliers in the features, so as to obtain the first target cloud security threat dataset.

[0042] Optionally, the acquisition module includes:

[0043] The first acquisition submodule is used to input the target features into the Pearson model and calculate the cloud security threat detection coefficients corresponding to each target feature.

[0044] Optionally, the first rejection module includes:

[0045] The first elimination submodule is used to sort the various cloud security threat detection coefficients and output a bar chart showing the correlation between feature values ​​and cloud security threat detection.

[0046] The second elimination submodule is used to determine the first feature to be eliminated from the target features based on the histogram, and to obtain the second feature.

[0047] Optionally, the second rejection module includes:

[0048] The third elimination submodule is used to construct a feature selection function by minimizing the sum of squared residuals plus a penalty term from a preset minimum absolute shrinkage and selection operator algorithm;

[0049] The fourth elimination submodule is used to eliminate the third feature in the second feature according to the preset value and the pre-built feature selection function to obtain the second target cloud security threat dataset.

[0050] Optionally, the output module includes:

[0051] The output submodule is used to input the second target cloud security threat dataset into the enhancement model and output the cloud security threat detection results corresponding to at least one algorithm integrated in the enhancement model.

[0052] Optionally, the output submodule includes;

[0053] The first output unit is used to input the second target cloud security threat dataset into the improvement model and output the subject operating characteristic curves and area under the curves corresponding to each algorithm integrated in the improvement model.

[0054] The second output unit is used to determine the target algorithm in the improvement model based on the subject working characteristic curve and the area under the curve.

[0055] The third output unit is used to output the cloud security threat detection results corresponding to the second target cloud security threat dataset through the target algorithm.

[0056] Thirdly, embodiments of this application also provide an electronic device, including: a processor; and a memory for storing processor-executable instructions, wherein the processor is configured to execute the instructions to implement the cloud security threat detection method as described above.

[0057] Fourthly, embodiments of this application also provide a storage medium that, when the instructions in the storage medium are executed by the processor of an electronic device, enables the electronic device to perform any of the cloud security threat detection methods described above.

[0058] In this embodiment, a first target cloud security threat dataset is obtained by preprocessing a pre-acquired cloud security threat dataset, which includes target features. Cloud security threat detection coefficients corresponding to each target feature are obtained. A first feature is removed from the target features based on the cloud security threat detection coefficients to obtain a second feature. A third feature is removed from the second feature based on a preset value and a pre-constructed feature selection function to obtain a second target cloud security threat dataset. The cloud security threat detection result corresponding to the second target cloud security threat dataset is then output. In other words, in this embodiment, a first target dataset containing target features is obtained by preprocessing a pre-acquired cloud security threat dataset, and cloud security threat detection coefficients for each target feature are calculated. Irrelevant first features are removed based on the detection coefficients to obtain the second feature. Redundant third features in the second feature are further removed using preset values ​​and a feature selection function, ultimately generating the second target cloud security threat dataset. This dataset, by simplifying features, improves the accuracy and efficiency of cloud security threat detection, resulting in more reliable and accurate detection results.

[0059] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0060] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of this application. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0061] Figure 1This is a flowchart illustrating the steps of a cloud security threat detection method provided in an embodiment of this application;

[0062] Figure 2 This is a block diagram of a cloud security threat detection device provided in an embodiment of this application;

[0063] Figure 3 This is a structural diagram of an electronic device provided in an embodiment of this application;

[0064] Figure 4 This is a schematic diagram of an exemplary cloud security threat detection method provided in an embodiment of this application;

[0065] Figure 5 This is an exemplary diagram illustrating the correlation between features and threat detection, provided in an embodiment of this application.

[0066] Figure 6 This is a schematic diagram comparing the ROC curves of three exemplary Boosting models provided in this application embodiment. Detailed Implementation

[0067] Exemplary embodiments of the present application will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present application are shown in the drawings, it should be understood that the present application may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this application will be thorough and complete, and will fully convey the scope of the present application to those skilled in the art.

[0068] It should be noted that, in the embodiments of this application, a cloud security threat detection method based on feature optimization and Boosting algorithm is proposed. For example... Figure 4 As shown, this invention consists of several parts: data preprocessing, feature optimization, Boosting algorithm processing, and model evaluation. First, the collected security threat data is preprocessed, using the mean or a fixed value to fill missing values ​​and deleting outliers with excessively high missing values. Then, the preprocessed dataset is divided into a test set and a training set. The feature dimensions of the training set are reduced using Pearson correlation coefficient and the Lasso algorithm. Finally, the dimensionality-reduced training and test sets are used to train models using Boosting ensemble learning algorithms LightGBM, XGBoost, and CatBoost, respectively, to obtain prediction results.

[0069] Figure 1 This is a flowchart illustrating the steps of a cloud security threat detection method provided in an embodiment of this application, such as... Figure 1 As shown, the method includes:

[0070] Step 101: Preprocess the pre-acquired cloud security threat dataset to obtain a first target cloud security threat dataset, which includes target features;

[0071] Furthermore, the preprocessing of the pre-acquired cloud security threat dataset to obtain the first target cloud security threat dataset includes:

[0072] Obtain cloud security threat datasets;

[0073] Determine whether there are missing values, and / or outliers in the features of the cloud security threat dataset;

[0074] If the features in the cloud security threat dataset have missing values, then the missing values ​​are filled with fixed values ​​or deleted; and / or,

[0075] If there are outliers in the features of the cloud security threat dataset, then the outliers are padded with the mean or deleted to obtain the first target cloud security threat dataset.

[0076] It should be noted that, in this embodiment, the first step is to collect cloud security threat data, i.e., to obtain a cloud security threat dataset. This data can be obtained from various sources, such as: security log collectors: These can collect security logs from various cloud platforms, applications, and network devices, including login records, access records, and abnormal events; security devices: Deploying security devices such as firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS) can collect network traffic data, attack events, and abnormal behavior data; Security Information and Event Management (SIEM) systems: SIEM systems can integrate various security data sources and analyze and report on the data, helping organizations monitor and respond to cloud security threats; security compliance tools: These tools can help organizations collect and analyze security data that complies with regulations and standards, including data on data protection, access control, and authentication; and security analysis tools: These tools can help organizations conduct in-depth analysis of cloud security data, discover potential security threats and vulnerabilities, and provide real-time security threat intelligence.

[0077] Therefore, to facilitate understanding of this application by those skilled in the art, the embodiments of this application will use a security threat dataset A collected from a Web application firewall and server security guard as an example for subsequent analysis.

[0078] After obtaining the cloud security threat dataset A, the data needs to be preprocessed. Operations such as filling missing values ​​and deleting outliers are performed on the obtained dataset A to obtain the first target cloud security threat dataset A0, so that the data are under the same scale and the data representation ability is improved.

[0079] Specifically, the processing of the cloud security threat dataset A is described in detail using this example. Dataset A has as many as 26 data features, divided into 6 categories, including traffic features, user behavior features, statistical features, location features, attack features, and protection features.

[0080] First, handling missing values. Of the original 26 features in the cloud security threat dataset A, 19 features contain missing values, and 6 features have a missing value ratio of more than 30%. Features with an excessively high missing value ratio are deleted entirely, and 2 features are filled with fixed values.

[0081] Second, outlier detection. Outliers are abnormal values ​​in the dataset. They may be incorrect "dirty data" or correct abnormal data. They need to be analyzed in detail. For some features, mean filling is used to process them, and some data that cannot be processed is deleted.

[0082] After processing for missing and outlier values, 18 feature variables were retained, totaling 3862 samples. As shown in Table 1, the target features in the cloud security threat dataset A in this embodiment of the application include the following data feature indicators to identify cloud security threat risks.

[0083] Table 1. Target Feature Indicators and Explanations in Cloud Security Threat Dataset A

[0084]

[0085]

[0086] Step 102: Obtain the cloud security threat detection coefficients corresponding to each of the target features;

[0087] Furthermore, obtaining the cloud security threat detection coefficients corresponding to each of the target features includes:

[0088] The target features are input into the Pearson model to calculate the cloud security threat detection coefficient corresponding to each target feature.

[0089] It should be noted that in this embodiment, Pearson coefficients are used to analyze the correlation between features and credit, Lasso is used to extract features with high importance, feature selection is performed, data dimensionality is reduced, high-dimensional risks are reduced, and the second target cloud security threat dataset A1 with optimized features is output.

[0090] Therefore, the first step is to use the Pearson coefficient to analyze the correlation between features and creditworthiness. Specifically, the Pearson coefficient has characteristics such as decentralization and normalization, and it performs excellently in reflecting the correlation between target values ​​and feature values. Therefore, it is widely used to measure the degree of linear correlation between features. Its formula is as follows:

[0091]

[0092] In Formula 1 above, variable x represents the feature value, and variable y represents the credit score. The Pearson correlation coefficient is the product of the covariance of these two variables divided by their standard deviations. The coefficient r(x,y) ranges from -1 to 1; a value closer to 1 or -1 indicates a stronger positive or negative correlation, while a value closer to 0 indicates a weaker correlation. The Pearson coefficient performs well in retaining preferred features and effectively reflects the linear correlation between features, making it suitable for feature selection in credit scoring.

[0093] Step 103: Based on the cloud security threat detection coefficient, remove the first feature from the target features to obtain the second feature;

[0094] Furthermore, the step of removing the first feature from the target features based on the cloud security threat detection coefficient to obtain the second feature includes:

[0095] The cloud security threat detection coefficients are sorted and a bar chart showing the correlation between feature values ​​and cloud security threat detection is output.

[0096] Based on the histogram, the first feature to be removed from the target features is determined, and the second feature is obtained.

[0097] like Figure 5 As shown, to reduce the feature dimensionality of the dataset and improve the accuracy and efficiency of data analysis, the preprocessed feature variables were input into the Pearson model. The correlation coefficients between each feature and cloud security threat detection were calculated, sorted, and output as a bar chart of the correlation between feature values ​​and cloud security threat detection. The chart reveals that some features have low correlation with cloud security threat detection; these features were removed, retaining only the remaining features with high correlation. This step removed three low-correlation features: A06, A11, and A08, retaining the remaining 15 features.

[0098] Step 104: Based on the preset values ​​and the pre-built feature selection function, remove the third feature from the second feature to obtain the second target cloud security threat dataset;

[0099] Furthermore, the step of removing the third feature from the second feature based on a pre-set preset value and a pre-constructed feature selection function to obtain the second target cloud security threat dataset includes:

[0100] The feature selection function is constructed by minimizing the sum of squared residuals, adding a pre-defined minimum absolute shrinkage and a penalty term to the selection operator algorithm;

[0101] The second target cloud security threat dataset is obtained by removing the third feature from the second feature based on the preset values ​​and the pre-built feature selection function.

[0102] The Lasso algorithm is a feature selection method based on linear regression models. It reduces feature dimensionality by filtering and compressing variables, effectively preventing overfitting. The Lasso algorithm uses the L1 norm to construct a penalty function. Based on minimizing the sum of squared errors in multiple linear regression, it adds a penalty function to the regression coefficients, compressing the regression coefficients of variables with low correlation to the model results to 0, thereby removing these feature variables and achieving the goal of reducing feature dimensionality.

[0103] The Lasso feature selection method minimizes the sum of squared residuals plus a penalty term based on the L1 norm, as shown in the following formula:

[0104]

[0105] In formula 2 above, x i The actual value of variable x representing individual i; This represents the estimated value of variable x for individual i; This represents the difference between the estimated value and the actual value; λ represents the regression coefficient. λ is a pre-defined non-negative number whose magnitude determines the algorithm's selectivity. If λ is too large, it will prevent the deletion of any features. By setting λ to a suitable low value, the coefficients of features with low class correlation can be reduced to 0, thereby deleting these features and highlighting features with strong class correlation, thus achieving feature selection in the dataset.

[0106] The Lasso algorithm adds an L1 normal form function as a penalty term, compressing the regression coefficients of features with absolute values ​​less than a threshold to 0. This effectively ignores the contribution of these feature variables to the classification result, thus eliminating them. In the Lasso algorithm, the magnitude of λ determines its selectivity; therefore, this step fine-tunes its value to select the most suitable one. The results of λ fine-tuning in Lasso are shown in Table 2.

[0107] Table 2 Comparison of the number of variables with different λ values

[0108] Number of variables 4 9 13 15 λ 0.01 0.005 0.0025 0.001

[0109] When λ is 0.01, the model exhibits underfitting, retaining only 4 of the 15 feature variables. After multiple tests comparing the training and test set scores, the difference between the scores was relatively small when λ was between 0.005 and 0.0025. When λ decreased to 0.001, the difference between the training and test set scores became significant, indicating overfitting. Therefore, this paper chose λ = 0.0025 for the experiment, retaining 13 samples.

[0110] Step 105: Output the cloud security threat detection results corresponding to the second target cloud security threat dataset.

[0111] Furthermore, the output of the cloud security threat detection results corresponding to the second target cloud security threat dataset includes:

[0112] The second target cloud security threat dataset is input into the enhancement model, and the cloud security threat detection results corresponding to at least one algorithm integrated in the enhancement model are output.

[0113] Furthermore, the step of inputting the second target cloud security threat dataset into the enhancement model and outputting the cloud security threat detection results corresponding to at least one algorithm integrated in the enhancement model includes:

[0114] The second target cloud security threat dataset is input into the enhancement model, and the subject operating characteristic curves and area under the curves corresponding to each algorithm integrated in the enhancement model are output.

[0115] The target algorithm in the improvement model is determined based on the subject operating characteristic curve and the area under the curve.

[0116] The target algorithm outputs the cloud security threat detection results corresponding to the second target cloud security threat dataset.

[0117] It should be noted that, in the embodiments of this application, the second target cloud security threat dataset A1 after feature processing is fed into the Boosting ensemble learning algorithms LightGBM, XGBoost, and CatBoost for model evaluation, and the cloud security threat detection results based on feature optimization and Boosting algorithms are output.

[0118] Even with imbalanced sample data, AUC values ​​and ROC curves can still reflect the predictive ability of a model well. Therefore, in order to quantify the quality of a model, AUC values ​​and ROC curves are used to evaluate the performance of a classifier.

[0119] Among them, the ROC curve (Receiver Operating Characteristic Curve) is a graphical tool used to evaluate the performance of classification models. The ROC curve shows the model's performance at different thresholds by plotting the relationship between the True Positive Rate (TPR) and the False Positive Rate (FPR).

[0120] AUC (Area Under the Curve): The AUC value is the area under the ROC curve, used to quantify the overall performance of a model. The AUC value ranges from 0 to 1, with a higher value indicating better classification performance.

[0121] The confusion matrix is ​​mainly used to compare classification results with the true information of instances. It can comprehensively reflect the performance of the model. The confusion matrix is ​​shown in Table 3 below.

[0122] Table 3 Confusion Matrix

[0123]

[0124] In Table 3, TP represents the number of samples that are both good and predicted as good, FN represents the number of samples that are both good and predicted as bad, FP represents the number of samples that are both bad and predicted as good, and TN represents the number of samples that are both bad and predicted as bad.

[0125] In this context, TPR = TP / (TP+FN) is called the True Positive Rate, which describes the proportion of correctly predicted positive instances out of all true positive instances. FPR = FP / (FP+TN) is called the False Positive Rate, which calculates the proportion of negative instances that are predicted as positive out of all true negative instances.

[0126] The ROC curve is a curve with the false positive rate (FPR) on the horizontal axis and the true positive rate (TPR) on the vertical axis. The AUC value is the area enclosed by the ROC curve and the X-axis. The closer the ROC curve is to the upper left corner of the coordinate axis, the better the model's performance; that is, the larger the AUC value, the better.

[0127] To demonstrate the effectiveness of Boosting ensemble learning algorithms in cloud security threat detection, XGBoost, CatBoost, and LightGBM ensemble learning algorithms were introduced. A five-fold crossover algorithm was used to train the dataset to reduce the impact of randomness on the classification results. The results are shown in Table 4.

[0128] Table 4 Comparison of AUC values ​​for the three Boosting models

[0129]

[0130] To more intuitively compare the training effects of the three models, a ROC curve comparison chart is used, such as... Figure 6 As shown, the closer the curve is to the upper left, the better the model's classification performance. XGBoost's curves are all at the top of the graph, indicating the best training performance; while LightGBM's ROC curves are all at the bottom, showing the worst results among the three models.

[0131] In this embodiment, a first target cloud security threat dataset is obtained by preprocessing a pre-acquired cloud security threat dataset, which includes target features. Cloud security threat detection coefficients corresponding to each target feature are obtained. A first feature is removed from the target features based on the cloud security threat detection coefficients to obtain a second feature. A third feature is removed from the second feature based on a preset value and a pre-constructed feature selection function to obtain a second target cloud security threat dataset. The cloud security threat detection result corresponding to the second target cloud security threat dataset is then output. In other words, in this embodiment, a first target dataset containing target features is obtained by preprocessing a pre-acquired cloud security threat dataset, and cloud security threat detection coefficients for each target feature are calculated. Irrelevant first features are removed based on the detection coefficients to obtain the second feature. Redundant third features in the second feature are further removed using preset values ​​and a feature selection function, ultimately generating the second target cloud security threat dataset. This dataset, by simplifying features, improves the accuracy and efficiency of cloud security threat detection, resulting in more reliable and accurate detection results.

[0132] Figure 2 This is a device block diagram of a cloud security threat detection device provided in an embodiment of this application, such as... Figure 2 As shown, the device includes:

[0133] Preprocessing module 201 is used to preprocess the pre-acquired cloud security threat dataset to obtain a first target cloud security threat dataset, wherein the first target cloud security threat dataset includes target features;

[0134] The acquisition module 202 is used to acquire the cloud security threat detection coefficients corresponding to each of the target features;

[0135] The first elimination module 203 is used to eliminate the first feature from the target features according to the cloud security threat detection coefficient to obtain the second feature;

[0136] The second elimination module 204 is used to eliminate the third feature in the second feature according to the preset value and the pre-built feature selection function to obtain the second target cloud security threat dataset.

[0137] The output module 205 is used to output the cloud security threat detection results corresponding to the second target cloud security threat dataset.

[0138] Optionally, the preprocessing module includes:

[0139] The first preprocessing submodule is used to acquire a cloud security threat dataset;

[0140] The second preprocessing submodule is used to determine whether there are missing values ​​and / or outliers in the features of the cloud security threat dataset;

[0141] The third preprocessing submodule is used to fill in or delete missing values ​​for the missing features in the cloud security threat dataset if such values ​​exist; and / or,

[0142] The fourth preprocessing submodule is used to fill or delete outliers in the cloud security threat dataset if there are outliers in the features, so as to obtain the first target cloud security threat dataset.

[0143] Optionally, the acquisition module includes:

[0144] The first acquisition submodule is used to input the target features into the Pearson model and calculate the cloud security threat detection coefficients corresponding to each target feature.

[0145] Optionally, the first rejection module includes:

[0146] The first elimination submodule is used to sort the various cloud security threat detection coefficients and output a bar chart showing the correlation between feature values ​​and cloud security threat detection.

[0147] The second elimination submodule is used to determine the first feature to be eliminated from the target features based on the histogram, and to obtain the second feature.

[0148] Optionally, the second rejection module includes:

[0149] The third elimination submodule is used to construct a feature selection function by minimizing the sum of squared residuals plus a penalty term from a preset minimum absolute shrinkage and selection operator algorithm;

[0150] The fourth elimination submodule is used to eliminate the third feature in the second feature according to the preset value and the pre-built feature selection function to obtain the second target cloud security threat dataset.

[0151] Optionally, the output module includes:

[0152] The output submodule is used to input the second target cloud security threat dataset into the enhancement model and output the cloud security threat detection results corresponding to at least one algorithm integrated in the enhancement model.

[0153] Optionally, the output submodule includes;

[0154] The first output unit is used to input the second target cloud security threat dataset into the improvement model and output the subject operating characteristic curves and area under the curves corresponding to each algorithm integrated in the improvement model.

[0155] The second output unit is used to determine the target algorithm in the improvement model based on the subject working characteristic curve and the area under the curve.

[0156] The third output unit is used to output the cloud security threat detection results corresponding to the second target cloud security threat dataset through the target algorithm.

[0157] In this embodiment, a first target cloud security threat dataset is obtained by preprocessing a pre-acquired cloud security threat dataset, which includes target features. Cloud security threat detection coefficients corresponding to each target feature are obtained. A first feature is removed from the target features based on the cloud security threat detection coefficients to obtain a second feature. A third feature is removed from the second feature based on a preset value and a pre-constructed feature selection function to obtain a second target cloud security threat dataset. The cloud security threat detection result corresponding to the second target cloud security threat dataset is then output. In other words, in this embodiment, a first target dataset containing target features is obtained by preprocessing a pre-acquired cloud security threat dataset, and cloud security threat detection coefficients for each target feature are calculated. Irrelevant first features are removed based on the detection coefficients to obtain the second feature. Redundant third features in the second feature are further removed using preset values ​​and a feature selection function, ultimately generating the second target cloud security threat dataset. This dataset, by simplifying features, improves the accuracy and efficiency of cloud security threat detection, resulting in more reliable and accurate detection results.

[0158] Figure 3 This is a structural diagram of an electronic device M00 provided in an embodiment of this application. In the diagram, the electronic device M00 includes a processor M01 and a memory M02. The electronic device includes: a processor; and a memory for storing executable instructions of the processor. The processor is configured to execute the instructions to implement any of the cloud security threat detection methods described above, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0159] In embodiments of this application, the memory M02 can be used to store software programs and various data. The memory M02 may primarily include a first storage area for storing programs or instructions and a second storage area for storing data. The first storage area may store the operating system, applications or instructions required for at least one function (such as sound playback, image playback, etc.). Furthermore, the memory M02 may include volatile memory or non-volatile memory, or the memory x09 may include both volatile and non-volatile memory. The non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct memory bus RAM (DRRAM). The memory M02 in the embodiments of this application includes, but is not limited to, these and any other suitable types of memory.

[0160] The processor M01 may include one or more processing units; optionally, the processor M01 integrates an application processor and a modem processor, wherein the application processor mainly handles operations involving the operating system, user interface, and applications, and the modem processor mainly handles wireless communication signals, such as a baseband processor. It is understood that the aforementioned modem processor may also not be integrated into the processor M01.

[0161] This application also provides a readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the various processes of the above-described cloud security threat detection method embodiments and achieve the same technical effects. To avoid repetition, they will not be described again here.

[0162] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0163] This application embodiment also provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run programs or instructions to implement the various processes of the above-described cloud security threat detection method embodiments and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0164] It should be understood that the chip involved in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0165] This application also provides a storage medium that, when the instructions in the storage medium are executed by the processor of an electronic device, enables the electronic device to perform any of the cloud security threat detection methods described above.

[0166] This application provides a computer program product stored in a storage medium. The program product is executed by at least one processor to implement the various processes of the cloud security threat detection method embodiment described above, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0167] This application also provides a vehicle that includes the cloud security threat detection device described above.

[0168] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0169] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the related technology, can be embodied in the form of a computer software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0170] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A cloud security threat detection method, characterized in that, The method includes: The pre-acquired cloud security threat dataset is preprocessed to obtain a first target cloud security threat dataset, which includes target features; Obtain the cloud security threat detection coefficients corresponding to each of the target features; The second feature is obtained by removing the first feature from the target features based on the cloud security threat detection coefficient; The third feature in the second feature is removed based on the preset value and the pre-built feature selection function to obtain the second target cloud security threat dataset. Output the cloud security threat detection results corresponding to the second target cloud security threat dataset; The output of the cloud security threat detection results corresponding to the second target cloud security threat dataset includes: The second target cloud security threat dataset is input into the enhancement model, and the cloud security threat detection results corresponding to at least one algorithm integrated in the enhancement model are output. The step of inputting the second target cloud security threat dataset into the enhancement model and outputting the cloud security threat detection results corresponding to at least one algorithm integrated in the enhancement model includes: The second target cloud security threat dataset is input into the enhancement model, and the subject operating characteristic curves and area under the curves corresponding to each algorithm integrated in the enhancement model are output. The target algorithm in the improvement model is determined based on the subject operating characteristic curve and the area under the curve. The target algorithm outputs the cloud security threat detection results corresponding to the second target cloud security threat dataset.

2. The method according to claim 1, characterized in that, The preprocessing of the pre-acquired cloud security threat dataset to obtain the first target cloud security threat dataset includes: Obtain cloud security threat datasets; Determine whether there are missing values ​​and / or outliers in the features of the cloud security threat dataset; If the features in the cloud security threat dataset have missing values, then the missing values ​​are filled with fixed values ​​or deleted; and / or, If there are outliers in the features of the cloud security threat dataset, then the outliers are padded with the mean or deleted to obtain the first target cloud security threat dataset.

3. The method according to claim 1, characterized in that, The process of obtaining the cloud security threat detection coefficients corresponding to each of the target features includes: The target features are input into the Pearson model to calculate the cloud security threat detection coefficient corresponding to each target feature.

4. The method according to claim 1, characterized in that, The step of removing the first feature from the target features based on the cloud security threat detection coefficient to obtain the second feature includes: The cloud security threat detection coefficients are sorted and a bar chart showing the correlation between feature values ​​and cloud security threat detection is output. Based on the histogram, the first feature to be removed from the target features is determined, and the second feature is obtained.

5. The method according to claim 1, characterized in that, The step of removing the third feature from the second feature based on a pre-set preset value and a pre-constructed feature selection function to obtain the second target cloud security threat dataset includes: The feature selection function is constructed by minimizing the sum of squared residuals, adding a pre-defined minimum absolute shrinkage and a penalty term to the selection operator algorithm; The second target cloud security threat dataset is obtained by removing the third feature from the second feature based on the preset values ​​and the pre-built feature selection function.

6. A cloud security threat detection device, characterized in that, The device includes: The preprocessing module is used to preprocess the pre-acquired cloud security threat dataset to obtain a first target cloud security threat dataset, which includes target features; The acquisition module is used to acquire the cloud security threat detection coefficients corresponding to each of the target features; The first elimination module is used to eliminate the first feature from the target features based on the cloud security threat detection coefficient to obtain the second feature; The second elimination module is used to eliminate the third feature in the second feature according to the preset value and the pre-built feature selection function to obtain the second target cloud security threat dataset. The output module is used to output the cloud security threat detection results corresponding to the second target cloud security threat dataset; The output module includes: The output submodule is used to input the second target cloud security threat dataset into the enhancement model and output the cloud security threat detection results corresponding to at least one algorithm integrated in the enhancement model. The output submodule includes: The first output unit is used to input the second target cloud security threat dataset into the improvement model and output the subject operating characteristic curves and area under the curves corresponding to each algorithm integrated in the improvement model. The second output unit is used to determine the target algorithm in the improvement model based on the subject working characteristic curve and the area under the curve. The third output unit is used to output the cloud security threat detection results corresponding to the second target cloud security threat dataset through the target algorithm.

7. An electronic device, characterized in that, include: processor; Memory used to store the processor's executable instructions; The processor is configured to execute the instructions to implement the cloud security threat detection method as described in any one of claims 1-5.

8. A computer storage medium, a readable storage medium for storing a program, characterized in that, When the program is executed by the processor, it implements the cloud security threat detection method as described in any one of claims 1-5.

Images