Big data attack processing system for cloud service

Abstract

The invention relates to the technical field of cloud computing security, and discloses a big data attack processing system for cloud services, which comprises a feature matrix construction module, an abnormal behavior prediction module, a behavior chain construction module, a behavior chain optimization module and a malicious behavior chain graph generation module. Compared with an attack detection method depending on single log analysis or in-session behavior characteristics in the prior art, the technical problem that cross-dimension and cross-session behavior association analysis cannot be realized especially under the condition that an attack chain may cross logs and multiple sessions and has strong time and behavior association in a complex attack scene is solved. According to the method, cross-log tracking of malicious behavior chains in large-scale log data is realized by introducing a behavior chain optimization technology of a graph convolutional network, so that the problems of insufficient complex behavior chain detection capability and inaccurate association analysis in the traditional technology are avoided; the accuracy of attack detection, the integrity of attack chain tracking and the overall security protection capability of the cloud service are improved.

Description

Technical Field

[0001] The present invention belongs to the field of cloud computing security technology, and in particular relates to a big data attack processing system for cloud services. Background Art

[0002] At present, with the widespread application of cloud services and the increase in business complexity, security threats in cloud service environments are becoming increasingly complex, especially in large-scale distributed environments, where attack behaviors are often diverse and cross-session and cross-log. However, existing attack detection technologies have many shortcomings. For example, traditional methods based on rule matching or statistical analysis cannot cope with dynamic behavior patterns in complex attack scenarios and lack the ability to deeply analyze multidimensional features. In addition, existing technologies are usually limited to the analysis of a single log or a single session, and cannot perform global correlation analysis and behavior chain tracking. Existing technologies cannot fully meet the needs of cloud services for cross-log and cross-session behavior correlation analysis in complex attack scenarios. Therefore, there is an urgent need for a method that can still achieve efficient and accurate cross-dimensional attack behavior correlation analysis in a multi-source heterogeneous log data environment, so as to improve the detection capability of complex attack behaviors and the integrity of malicious behavior chain tracking, thereby providing a more comprehensive security guarantee for the cloud service environment. Summary of the invention

[0003] In view of the above-mentioned technical deficiencies, the purpose of the present invention is to propose a big data attack processing system for cloud services, aiming to solve the attack detection method in the prior art that relies on single log analysis or behavioral features within a session, especially in complex attack scenarios, where the attack chain may span logs, multiple sessions and have a strong correlation between time and behavior, and the technical problem of being unable to achieve cross-dimensional and cross-session behavioral correlation analysis.

[0004] In order to solve the above technical problems, the present invention adopts the following technical solution: The present invention provides a big data attack processing system for cloud services, comprising:

[0005] The feature matrix building module is used to collect multi-source transaction log data from cloud services. The multi-source transaction log data includes: timestamp T i , used to indicate the recording time of the i-th transaction log; operation type A i , used to indicate user operation behaviors, including user login, user logout, and user file operations; network address IP i , used to indicate the source of the user's network address; device type D i , used to indicate the type of terminal device used by the user; user identification UID i , used to identify cloud service users; interface request identifier SID i , used to identify the interface request address of the i-th transaction log; generating a cloud service log feature matrix F according to multi-source transaction log data;

[0006] The abnormal behavior prediction module is used to generate user behavior vectors for n rows of the cloud service log feature matrix F and form a user behavior feature set V = {v1, v2, ..., v i ,…,v n}, where v i is the behavior feature of the ith user, v n is the nth user behavior feature; a deep learning algorithm is used to build a user behavior model, and the user behavior model is trained using a preset historical user behavior feature set. The user behavior feature set V is input into the user behavior model, and the user behavior model outputs an abnormal probability distribution P anomaly , P anomaly ={p1,p2,…,p i …,p n}, where p i represents the abnormal probability of the i-th transaction log;

[0007] The behavior chain building module is used to preset the abnormal probability threshold and matching distance threshold for the abnormal probability distribution P anomaly The mth transaction log and the nth transaction log whose abnormal probability exceeds the abnormal probability threshold are calculated for time series similarity to obtain the matching distance D(m,n) between the mth transaction log and the nth transaction log. If D(m,n) is greater than the preset matching distance threshold, the mth transaction log and the nth transaction log are associated to obtain the first user behavior chain;

[0008] The behavior chain optimization module is used to extract the first user behavior chain through the graph convolution network to obtain the feature values ​​of the mth transaction log and the nth transaction log, and calculate the probability distribution P of the attack intention based on the feature values ​​of the mth transaction log and the nth transaction log. Intent ; According to the probability distribution P of attack intention Intent Optimizing the first user behavior chain to obtain a second user behavior chain;

[0009] The malicious behavior chain graph generation module is used to generate a malicious behavior chain graph through the second user behavior chain, including: nodes of the malicious behavior chain graph, which are used to represent abnormal transaction logs; edges of the malicious behavior chain graph, which are used to represent the association relationship between nodes; a preset probability threshold τ, which distributes the probability distribution P of the attack intention Intent After the mth transaction log and the nth transaction log exceeding the preset probability threshold τ are set as risk nodes, the risk nodes are marked in the malicious behavior chain graph and the attack pattern graph is output.

[0010] Preferably, in the feature matrix construction module, the data format of the cloud service log feature matrix F is:

[0011]

[0012] The value of i is determined according to the actual data volume requirement.

[0013] Preferably, in the abnormal behavior prediction module, the formula of the user behavior model is:

[0014] p i =σ(W·f(V)+b)

[0015] Among them, f(V) is the feature mapping function of the user behavior feature set V; W is the weight matrix of the user behavior model; b is the bias term of the user behavior model; σ() is the activation function used to map the result to the [0, 1] interval.

[0016] Preferably, in the abnormal behavior prediction module, the optimization objective function formula used in the process of training the user behavior model using the preset historical user behavior feature set is:

[0017]

[0018] Where L is the value of the optimization objective function, which is used to measure the deviation between the model prediction value and the true value; N is the total number of samples in the historical user behavior feature set; y i is the true label of the i-th transaction log, y i =1 indicates abnormal transaction log, y i =0 means normal transaction log; p i is the probability that the i-th transaction log predicted by the user behavior model is abnormal, and its value range is [0, 1]; β1 is the weight of the abnormal transaction log, which is used to increase the model's attention to abnormal samples, and the default setting is β1>1; β2 is the weight of the normal transaction log, which is used to reduce false positives, and the default setting is β2<β1.

[0019] Preferably, in the behavior chain building module, the calculation formula of the matching distance D(m,n) is:

[0020] D(m,n)=min(D(m-1,n)+α t |T m -T n |,D(m,n-1)+α a |A m -A n |,D(m-1,n-1))

[0021] Where D(m-1,n) is the matching distance between the m-1th transaction log and the nth transaction log, D(m,n-1) is the matching distance between the mth transaction log and the n-1th transaction log, T m is the timestamp of the mth transaction log, T n is the timestamp of the nth transaction log, Am A is the operation type encoding value of the mth transaction log. n The operation type encoding value for the nth transaction log, α a and α t They are timestamp weight coefficient and operation type weight coefficient respectively.

[0022] Preferably, in the behavior chain optimization module, the probability distribution P of the attack intention Intent The calculation formula is:

[0023]

[0024] Among them, f m is the characteristic value of the mth transaction log; f n is the characteristic value of the nth transaction log; w m is the feature weight of the mth transaction log, w n is the feature weight of the nth transaction log; g mn is the interaction weight between the mth transaction log and the nth transaction log; γ is the adjustment parameter of the interaction weight between the mth transaction log and the nth transaction log, and M is the total number of transaction logs.

[0025] Preferably, in the behavior chain optimization module, the calculation formula for extracting the characteristic value of the mth transaction log is:

[0026]

[0027] in, is the characteristic value of the mth transaction log in the first user behavior chain at the l+1th layer; is the characteristic value of the nth transaction log in the first user behavior chain at the lth layer; W (l) is the weight matrix of the lth layer of the graph convolutional network; d m and d n is the normalization coefficient, which represents the number of connections between the nodes of the mth log and the nth log respectively; σ() is the activation function.

[0028] The beneficial effect of the present invention is that compared with the attack detection method in the prior art that relies on a single log analysis or intra-session behavioral features, especially in complex attack scenarios, the attack chain may cross logs, multiple sessions and have a strong time and behavior correlation, and the technical problem of being unable to achieve cross-dimensional and cross-session behavior correlation analysis is solved. Since the present application introduces a deep learning anomaly detection model, a time series matching algorithm and a behavior chain optimization technology of a graph convolutional network, it realizes the tracking of malicious behavior chains across logs and sessions in large-scale log data, thereby avoiding the problems of insufficient detection capabilities of complex behavior chains and inaccurate correlation analysis in traditional technologies, and improving the accuracy of attack detection, the integrity of attack chain tracking and the overall security protection capabilities of cloud services. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0030] Figure 1 A flowchart of a first embodiment of a big data attack processing system for cloud services provided by the present invention.

[0031] Figure 2 A schematic diagram of a device of a big data attack processing system for cloud services provided by the present invention. DETAILED DESCRIPTION

[0032] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0033] Embodiment 1: Figure 1 , which is a flow chart of the first embodiment of the big data attack processing system for cloud services of the present invention, proposes the first embodiment of the big data attack processing system for cloud services of the present invention.

[0034] In a first embodiment, the big data attack processing system for cloud services includes:

[0035] The feature matrix building module is used to collect multi-source transaction log data from cloud services. The multi-source transaction log data includes: timestamp T i, used to indicate the recording time of the i-th transaction log; operation type A i , used to indicate user operation behaviors, including user login, user logout, and user file operations; network address IP i , used to indicate the source of the user's network address; device type D i , used to indicate the type of terminal device used by the user; user identification UID i , used to identify cloud service users; interface request identifier SID i , used to identify the interface request address of the i-th transaction log; generating a cloud service log feature matrix F according to multi-source transaction log data;

[0036] It should be noted that the collected transaction log data is dynamic, and the data fields can be adjusted according to the actual cloud service scenario. The design purpose of the feature matrix is ​​to unify the data format to facilitate subsequent analysis and modeling. The feature matrix is ​​the basis of the entire attack detection process. The accuracy and comprehensiveness directly affect the performance of subsequent modules. The rows of the feature matrix represent each transaction log, and the columns represent the different dimensional features of the log. The construction of the feature matrix can be completed through automated scripts or log management tools, such as ELK (Elasticsearch, Logstash, Kibana), etc.

[0037] For example, there are two transaction logs as follows: Log 1: timestamp is "2024-01-01T12:00:00Z", operation type is "login", IP address is "192.168.1.1", device type is "PC", user ID is "user12345", interface request ID is " / api / login"; Log 2: timestamp is "2024-01-01T12:05:30Z", operation type is "file upload", IP address is "192.168.1.2", device type is "Mobile", user ID is "user67890", interface request ID is " m / api / upload”; the constructed feature matrix F is:

[0038]

[0039] The abnormal behavior prediction module is used to generate user behavior vectors for n rows of the cloud service log feature matrix F and form a user behavior feature set V = {v1, v2, ..., v i ,…,v n}, where v i is the behavior feature of the ith user, v nis the nth user behavior feature; a deep learning algorithm is used to build a user behavior model, and the user behavior model is trained using a preset historical user behavior feature set. The user behavior feature set V is input into the user behavior model, and the user behavior model outputs an abnormal probability distribution P anomaly , P anomaly ={p1,p2,…,p i …,p n}, where p i represents the abnormal probability of the i-th transaction log;

[0040] It should be noted that each dimension of the user behavior vector needs to be standardized or encoded to adapt to the format of the model input. For example, the timestamp can be converted into numerical features of hours and minutes, and the operation type can be encoded using one-hot encoding. The model needs to design a suitable deep network structure to capture the time correlation and multi-dimensional feature interactions of the data, and sample balance must be ensured during training; the abnormal probability distribution is the model's prediction result for each transaction log, which is used to evaluate the degree of abnormality of the log.

[0041] For example, part of the log feature matrix F is as follows

[0042]

[0043] Among them, T1 = "2024-01-01T12:00:00Z", A1 = "login", IP1 = "192.168.1.1", D1 = "PC", UID1 = "user123", SID1 = " / api / login"; T2 = "2024-01-01T12:05:00Z", A2 = "file upload", IP2 = "192.168.1.2", D2 = Mobile", UID2 = "user456", SID2 = " / api / upload"; Convert each row of F into a user behavior vector V = {[T1, A1, IP1, D1, UID1, SID1], [T2, A2, IP2, D2, UID2, SID2], [T3, A3, IP3, D3, UID3, SID3]}; The model outputs the abnormal probability distribution: P anomaly ={0.02,0.85,0.15}, p1 = 0.02, the first log is normal behavior; p2 = 0.85, the second log is highly suspected abnormal behavior; p3 = 0.15, the third log is slightly abnormal.

[0044] The behavior chain building module is used to preset the abnormal probability threshold and matching distance threshold for the abnormal probability distribution P anomalyThe mth transaction log and the nth transaction log whose abnormal probability exceeds the abnormal probability threshold are calculated for time series similarity to obtain the matching distance D(m,n) between the mth transaction log and the nth transaction log. If D(m,n) is greater than the preset matching distance threshold, the mth transaction log and the nth transaction log are associated to obtain the first user behavior chain;

[0045] It should be noted that the calculation formula of the matching distance D(m,n) is:

[0046] D(m,n)=min(D(m-1,n)+α t |T m -T n |,D(m,n-1)+α a |A m -A n |,D(m-1,n-1))

[0047] Where D(m-1,n) is the matching distance between the m-1th transaction log and the nth transaction log, D(m,n-1) is the matching distance between the mth transaction log and the n-1th transaction log, T m is the timestamp of the mth transaction log, T n is the timestamp of the nth transaction log, A m A is the operation type encoding value of the mth transaction log. n The operation type encoding value for the nth transaction log, α a and α t They are timestamp weight coefficient and operation type weight coefficient respectively.

[0048] It is understandable that the threshold setting needs to be optimized in combination with the actual business scenarios and data distribution to balance missed reports and false positives. For example, high-frequency operation scenarios in cloud services require a lower time similarity threshold; time series similarity combines multi-dimensional features such as time, operation type, and context, and can flexibly adjust weights to adapt to different attack modes; the matching distance formula uses a dynamic programming method to ensure the global optimal log association path and avoid the local optimal problem caused by simple similarity calculations.

[0049] For example, assume the following transaction logs: Log 1: timestamp T1 = 2024-01-01T12:00:00Z, operation type A1 = "login", context feature C1 = ["192.168.1.1", "PC", "user123"]; Log 2: timestamp T2 = 2024-01-01T12:02:30Z, operation type A2 = "file upload", context feature C_2 = ["192.168.1.1", "PC", "user123"]; Log 3: timestamp T3 = 2024-01-01T12:15:00Z, operation type A3 = "login", context feature C3 = ["192.168.2.3", "Mobile", "user456"]; Calculate similarity: D(1,2) = α t |T1-T2|+α a ·d a (A1,A2)+α c ·d c (C1,C2), if D(1,2) is greater than the preset matching distance threshold, the first and second logs are associated as the same behavior chain, and the first user behavior chain constructed includes the first and second logs.

[0050] The behavior chain optimization module is used to extract the first user behavior chain through the graph convolution network to obtain the feature values ​​of the mth transaction log and the nth transaction log, and calculate the probability distribution P of the attack intention based on the feature values ​​of the mth transaction log and the nth transaction log. Intent ; According to the probability distribution P of attack intention Intent Optimizing the first user behavior chain to obtain a second user behavior chain;

[0051] It should be noted that the probability distribution of attack intention P Intent The calculation formula is:

[0052]

[0053] Among them, f m is the characteristic value of the mth transaction log; f n is the characteristic value of the nth transaction log; w m is the feature weight of the mth transaction log, w n is the feature weight of the nth transaction log; g mn is the interaction weight between the mth transaction log and the nth transaction log; γ is the adjustment parameter of the interaction weight between the mth transaction log and the nth transaction log, and M is the total number of transaction logs.

[0054] It is understandable that the first user behavior chain may contain nodes that are mis-associated or missed, and the optimization process is a necessary step to make it more precise. High-probability nodes are potential key attack behaviors, and strengthening their association will help generate a more complete malicious behavior chain.

[0055] The malicious behavior chain graph generation module is used to generate a malicious behavior chain graph through the second user behavior chain, including: nodes of the malicious behavior chain graph, which are used to represent abnormal transaction logs; edges of the malicious behavior chain graph, which are used to represent the association relationship between nodes; a preset probability threshold τ, which distributes the probability distribution P of the attack intention Intent After the mth transaction log and the nth transaction log exceeding the preset probability threshold τ are set as risk nodes, the risk nodes are marked in the malicious behavior chain graph and the attack pattern graph is output.

[0056] It should be noted that by visualizing the malicious behavior chain, users can intuitively understand the attack path, key nodes and the relationship between nodes, which facilitates quick decision-making and response. Marking high-risk nodes helps focus attention on logs with greater potential threats, thereby improving analysis efficiency.

[0057] For example, assume that the second user behavior chain contains the following transaction logs: Node 1: timestamp T1 = "2024-01-01T12:00:00Z", operation type A1 = "login", attack intention probability p1 = 0.85; Node 2: timestamp T2 = "2024-01-01T12:05:30Z", operation type A2 = "file upload", attack intention probability p2 = 0.95; Node 3: timestamp T3 = "2024-01-01T12:15:00Z", operation type A3 = "file deletion", attack intention probability p3 = 0.60; preset threshold τ = 0.8, mark high-risk nodes: the attack intention probabilities p1, p2 of nodes 1 and 2 are greater than 0.8, so they are marked as high-risk nodes, and the attack intention probability p3 of node 3 is less than 0.8, so it is not marked as a high-risk node;

[0058] In addition, the present invention also provides a big data attack processing device for cloud services, please refer to Figure 2A big data attack processing device for cloud services includes: at least one processor; and a memory connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the big data attack processing system for cloud services in the above-mentioned embodiment 1. A big data attack processing device for cloud services in the embodiment of the present invention may include but is not limited to mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. A big data attack processing device for cloud services is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention. A big data attack processing device for cloud services may include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of a big data attack processing device for cloud services are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 1003 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 1009. The communication device 1009 can allow a big data attack processing device for cloud services to communicate wirelessly or wired with other devices to exchange data. Although the figure shows a big data attack processing device for cloud services with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems may be implemented or have alternatively.

[0059] The present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements a big data attack processing system for cloud services as described above. The computer program product provided by the present invention can solve a technical problem of big data attack processing for cloud services. Compared with the prior art, the beneficial effects of the computer program product provided by the present invention are the same as the beneficial effects of a big data attack processing system for cloud services provided by the above embodiment, which will not be repeated here.

[0060] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the system of the embodiments disclosed in the present invention are executed.

[0061] It should be understood that the various parts disclosed in the present invention can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0062] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A big data attack processing system for cloud services, characterized in that: The system includes: The feature matrix building module is used to collect multi-source transaction log data from cloud services. The multi-source transaction log data includes: timestamp T i , used to indicate the recording time of the i-th transaction log; operation type A i , used to indicate user operation behaviors, including user login, user logout, and user file operations; network address IP i , used to indicate the source of the user's network address; device type D i , used to indicate the type of terminal device used by the user; user identification UID i , used to identify cloud service users; interface request identifier SID i , used to identify the interface request address of the i-th transaction log; generating a cloud service log feature matrix F according to multi-source transaction log data; The abnormal behavior prediction module is used to generate user behavior vectors for n rows of the cloud service log feature matrix F and form a user behavior feature set V = {v1, v2, ..., v i ,…,v n }, where v i is the behavior feature of the ith user, v n is the nth user behavior feature; a deep learning algorithm is used to build a user behavior model, and the user behavior model is trained using a preset historical user behavior feature set. The user behavior feature set V is input into the user behavior model, and the user behavior model outputs an abnormal probability distribution P anomaly , P anomaly ={p1,p2,…,p i …,p n }, where p i represents the abnormal probability of the i-th transaction log; The behavior chain building module is used to preset the abnormal probability threshold and matching distance threshold for the abnormal probability distribution P anomaly The mth transaction log and the nth transaction log whose abnormal probability exceeds the abnormal probability threshold are calculated for time series similarity to obtain the matching distance D(m,n) between the mth transaction log and the nth transaction log. If D(m,n) is greater than the preset matching distance threshold, the mth transaction log and the nth transaction log are associated to obtain the first user behavior chain; The behavior chain optimization module is used to extract the first user behavior chain through the graph convolution network to obtain the feature values ​​of the mth transaction log and the nth transaction log, and calculate the probability distribution P of the attack intention based on the feature values ​​of the mth transaction log and the nth transaction log. Intent ; According to the probability distribution P of attack intention Intent Optimizing the first user behavior chain to obtain a second user behavior chain; The malicious behavior chain graph generation module is used to generate a malicious behavior chain graph through the second user behavior chain, including: nodes of the malicious behavior chain graph, which are used to represent abnormal transaction logs; edges of the malicious behavior chain graph, which are used to represent the association relationship between nodes; a preset probability threshold τ, which distributes the probability distribution P of the attack intention Intent After the mth transaction log and the nth transaction log exceeding the preset probability threshold τ are set as risk nodes, the risk nodes are marked in the malicious behavior chain graph and the attack pattern graph is output.

2. A big data attack processing system for cloud services according to claim 1, characterized in that: In the feature matrix construction module, the data format of the cloud service log feature matrix F is: The value of i is determined according to the actual data volume requirement.

3. A big data attack processing system for cloud services according to claim 1, characterized in that: In the abnormal behavior prediction module, the formula of the user behavior model is: p i =σ(W·f(V)+b) Among them, f(V) is the feature mapping function of the user behavior feature set V; W is the weight matrix of the user behavior model; b is the bias term of the user behavior model; σ() is the activation function used to map the result to the [0, 1] interval.

4. A big data attack processing system for cloud services as claimed in claim 1, characterized in that: In the abnormal behavior prediction module, the optimization objective function formula used in the process of training the user behavior model using the preset historical user behavior feature set is: Where L is the value of the optimization objective function, which is used to measure the deviation between the model prediction value and the true value; N is the total number of samples in the historical user behavior feature set; y i is the true label of the i-th transaction log, y i =1 indicates abnormal transaction log, y i =0 means normal transaction log; p i is the probability that the i-th transaction log predicted by the user behavior model is abnormal, and its value range is [0, 1]; β1 is the weight of the abnormal transaction log, which is used to increase the model's attention to abnormal samples, and the default setting is β1>1; β2 is the weight of the normal transaction log, which is used to reduce false positives, and the default setting is β2<β1.

5. A big data attack processing system for cloud services as claimed in claim 1, characterized in that: In the behavior chain building module, the calculation formula of the matching distance D(m,n) is: D(m,n)=min(D(m-1,n)+α t |T m -T n |,D(m,n-1)+α a |A m -A n |,D(m−1,n−1)) Where D(m-1,n) is the matching distance between the m-1th transaction log and the nth transaction log, D(m,n-1) is the matching distance between the mth transaction log and the n-1th transaction log, T m is the timestamp of the mth transaction log, T n is the timestamp of the nth transaction log, A m A is the operation type encoding value of the mth transaction log. n The operation type encoding value for the nth transaction log, α a and α t They are timestamp weight coefficient and operation type weight coefficient respectively.

6. A big data attack processing system for cloud services according to claim 1, characterized in that: In the behavior chain optimization module, the probability distribution of attack intention P Intent The calculation formula is: Among them, f m is the characteristic value of the mth transaction log; f n is the characteristic value of the nth transaction log; w m is the feature weight of the mth transaction log, w n is the feature weight of the nth transaction log; g mn is the interaction weight between the mth transaction log and the nth transaction log; γ is the adjustment parameter of the interaction weight between the mth transaction log and the nth transaction log, and M is the total number of transaction logs.

7. A big data attack processing system for cloud services as claimed in claim 1, characterized in that: In the behavior chain optimization module, the calculation formula for extracting the characteristic value of the mth transaction log is: in, is the characteristic value of the mth transaction log in the first user behavior chain at the l+1th layer; is the characteristic value of the nth transaction log in the first user behavior chain at the lth layer; W (l) is the weight matrix of the lth layer of the graph convolutional network; d m and d n is the normalization coefficient, which represents the number of connections between the nodes of the mth log and the nth log respectively; σ() is the activation function.

Images