A data security management method and system based on a cloud computing platform

Abstract

The application discloses a kind of data security management method and system based on cloud computing platform, it is related to data security management technical field, including: real-time acquisition cloud computing platform's original data and pre-processing;Based on the discriminant model of generation adversarial network GAN construction generates fake data sample, and with real data sample as input data, based on extreme learning machine, discriminant model is optimized using input data and discriminant attack data;Using hidden Markov model constructs security posture model and passes through cluster particle algorithm optimization parameter, based on real-time attack data output prediction security posture.It is generated through generation adversarial network and with the aid of extreme learning machine discriminant model, effectively improve the discriminant precision of attack data, through hidden Markov model establishes security posture model, and model parameter is optimized in combination with cluster particle algorithm, predicted attack path is combined with deep Q learning network, attack path prediction is carried out through double deep Q network, and defense strategy is adjusted in real time.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security management, in particular to a data security management method and system based on a cloud computing platform. BACKGROUND

[0002] With the rapid development of cloud computing technology, cloud computing platforms have become an important support for modern informationization construction. Cloud computing platforms integrate computing resources, storage resources and network resources to provide on-demand computing and storage services for users, greatly improving the efficiency of resource use and the flexibility of management. In particular, in the fields of enterprise information management, data processing and business intelligence, cloud computing platforms are increasingly widely used. However, with the widespread popularity of cloud computing, data security issues have gradually become an important challenge that needs to be addressed. Since cloud computing platforms carry a large amount of sensitive data and critical business, how to effectively protect the security of data and prevent data leakage, tampering and denial-of-service attacks and other security issues has become a key problem in the operation of cloud computing platforms.

[0003] Currently, traditional cloud computing platform data security protection mainly relies on static rules and feature-based security detection methods. For example, intrusion detection systems (IDS) and intrusion prevention systems (IPS) are widely used in cloud computing platform data security management to identify and intercept malicious activities by analyzing network traffic features, log information and behavior data. However, with the increasing complexity of attacks, especially advanced persistent threats (APT) and zero-day attacks against cloud computing platforms, existing static rules and feature-based security protection methods have been unable to cope with new threats. For example, traditional IDS / IPS systems usually rely on a pre-defined attack feature library when facing unknown attack patterns, which makes them less capable of identifying new attacks and prone to false positives and false negatives. In addition, traditional security protection methods are difficult to adapt in real time, and their defense effect is limited when facing large-scale distributed attacks or complex attack paths. Therefore, how to improve the intelligence, real-time performance and adaptability of data security management methods has become an important research direction in the field of cloud computing platform data security protection. SUMMARY

[0004] In view of the above existing problems, the present application is proposed.

[0005] Therefore, the present application provides a data security management method and system based on a cloud computing platform to solve the existing feature-based security protection technology, which has the problems of limited detection range and poor ability to cope with new attacks.

[0006] To solve the above technical problems, the present application provides the following technical solutions:

[0007] The application provides a cloud computing platform-based data security management method, which comprises the following steps:

[0008] Real-time collection of original data of the cloud computing platform and preprocessing;

[0009] The original data comprises security vulnerability data, node basic information and device configuration logs.

[0010] The original data is converted into numerical data and a random noise vector is obtained, a discriminant model is constructed based on a generative adversarial network (GAN) to generate fake data samples, and the real data samples are used as input data, the discriminant model is optimized based on an extreme learning machine (ELM) using the input data, and the attack data is discriminated;

[0011] A security posture model is constructed using a hidden Markov model (HMM) and the parameters are optimized through a swarm particle algorithm, and a predicted security posture is output based on real-time attack data;

[0012] The predicted security posture is substituted into a deep Q learning network (DQN) and combined with a double deep Q network (DDQN) to predict an attack path, and a defense strategy is adjusted in real time based on the predicted attack path graph.

[0013] As a preferred scheme of the cloud computing platform-based data security management method, the real-time collection of original data of the cloud computing platform and preprocessing comprises the following steps:

[0014] Each device in the cloud computing platform is regarded as a node, and an acquisition tool is used to collect the original data of each node in the cloud computing platform in real time;

[0015] The original data comprises security vulnerability data, node basic information and device configuration logs.

[0016] The preprocessing comprises the following steps: the collected original data is subjected to a de-duplication process, repeated records are deleted, the numerical data is interpolated using a mean interpolation method, and the abnormal values are detected and removed using a standard deviation method.

[0017] As a preferred scheme of the cloud computing platform-based data security management method, the conversion of the original data into numerical data and the obtaining of a random noise vector, the construction of a discriminant model based on a generative adversarial network (GAN) to generate fake data samples, and the use of the real data samples as input data comprise the following steps:

[0018] Features in the preprocessed original data are extracted, and the text type data and the category type data in the features are converted into numerical data and subjected to standardization;

[0019] A random noise vector of the numerical data is obtained using standard normal distribution sampling, and is used as the input of a generative adversarial network (GAN) generator;

[0020] Initialize the weight parameters of the generator and the discriminator of the generative adversarial network and , input a random noise vector into the generator to generate a fake data sample, input the data sample into the discriminator to output a discrimination value;

[0021] Define the loss function of the discriminator and the loss function of the generator The optimization goal of the discriminator is to maximize the loss function, a preset number of training rounds is set, and the generator and the discriminator are repeatedly trained alternately until the preset number of training rounds is reached, a fake data sample is generated by inputting a random noise vector into the trained generative adversarial network, and the real data sample and the fake data sample are input into the discriminator as input data.

[0022] As a preferred scheme of the data security management method based on the cloud computing platform, wherein: the limit learning machine is used to optimize the discrimination model and discriminate the attack data by using the input data, and the limit learning machine comprises:

[0023] Each set of input data of the discriminator is regarded as a sample, the weights and biases of each hidden layer node in the limit learning machine are randomly initialized, the input data of the discriminator is transmitted to each hidden layer node through the randomly initialized weights and biases, and a hidden layer output is generated by applying an activation function, all samples are calculated to construct a hidden layer output matrix ;

[0024] Calculate the loss function of all samples , the output weight is adjusted by using the gradient descent method to minimize the loss function, and the final output weight is obtained by solving the minimized loss function.

[0025] The final output weight is used to initialize the discrimination model, the input data is input into the discrimination model, the discrimination threshold is set according to the discrimination value output by the discriminator, the attack data is discriminated, if the discrimination value is greater than the discrimination threshold, the input data is real data, otherwise, the input data is attack data.

[0026] The discriminator is trained for multiple rounds, the output weight is updated using new input data each time, and the output weight is dynamically updated using the limit learning machine for incremental learning according to the new input data after each training is completed.

[0027] As a preferred scheme of the data security management method based on the cloud computing platform, wherein: the security posture model is constructed using the hidden Markov model, the parameters are optimized by using the cluster particle algorithm, and the real-time attack data is used to output the predicted security posture, and the hidden Markov model comprises:

[0028] The security posture of the cloud computing platform is defined as a Markov process, the hidden state is defined as the security posture of the whole of all nodes in the cloud computing platform, a security posture model is constructed using a hidden Markov model, and parameters of the security posture model are initialized;

[0029] The parameter optimization through the swarm particle algorithm includes initializing the initial position and initial speed of each particle in the particle swarm using a random number, selecting the size of the particle swarm, and initializing the initial position and initial speed of each particle in the particle swarm using a random number.

[0030] The particle swarm is divided into multiple clusters using K-means clustering, each cluster representing a local optimal solution region, the particles in each cluster are independently evaluated for fitness, and the particles in the cluster share a common best position.

[0031] The fitness of each particle is calculated through a fitness function, the position and speed of the particle are updated according to a speed adjustment formula, the position and speed of the particle are updated, the fitness of the particle is re-evaluated, the new position of each particle corresponds to a new solution, the fitness of all particles is compared, the particle with the maximum fitness is selected as the global optimal particle, and the global best position is updated.

[0032] The global optimal particle is selected as the final parameter of the security posture model.

[0033] The attack data at different time steps is used as the observation sequence, the Viterbi algorithm is used to decode the optimal hidden state sequence, the probability of the initial state is initialized, for each time step and each hidden state in the observation sequence, the maximum probability of each hidden state is recursively calculated, and the most likely hidden state sequence is found by recording the source of the maximum probability at each time step using a backtracking process.

[0034] The performance of the security posture model is detected by evaluating the log-likelihood value of the model, and the model parameters are fine-tuned according to the log-likelihood value and other performance evaluation indicators.

[0035] The real-time attack data is substituted into the security posture model to output the predicted security posture.

[0036] As a preferred scheme of the data security management method based on the cloud computing platform, wherein: the predicted security posture is substituted into the deep Q learning network, which includes:

[0037] defining a state space and an action space , using MulVAL to generate an attack path graph between nodes in the cloud computing platform and integrating it into the state space ;

[0038] As a preferred scheme of the data security management method based on the cloud computing platform, the attack path prediction based on the double deep Q network comprises:

[0039] The deep Q learning network is used as an initial Q network, and the double deep Q network is used as a target Q network.

[0040] The initial Q network and the target Q network are initialized, and a deep neural network is created The initial Q network is represented, wherein The parameters of the initial Q network are represented, and a double deep Q network is created , wherein The parameters of the target Q network are represented.

[0041] The agent will evaluate all actions in the action space at each time point According to the current state space The action space is evaluated , through The greedy strategy balances exploration and utilization, and the agent selects an action with the maximum current Q value with a probability of The probability of selecting a random action is The probability of selecting a random action is The exploration rate represents the probability of the agent selecting a random action.

[0042] According to the node definition reward function The reward function includes a new node reward, a control network node reward, and a collected credential reward.

[0043] The target Q value is calculated using the target Q network , the next optimal action is selected, and after performing an action, the agent updates the Q value through the difference between the current Q value and the target Q value.

[0044] The parameters of the initial Q network are updated to the target Q network regularly.

[0045] Based on the attack path graph generated by MulVAL, the agent preferentially evaluates each possible attack path and selects the path that maximizes the reward, and through real-time analysis of the attack path, the agent adjusts the defense strategy in real time.

[0046] In a second aspect, the present application provides a data security management system based on a cloud computing platform, comprising:

[0047] A data acquisition module is used to acquire and preprocess raw data of the cloud computing platform in real time.

[0048] The noise generation module is configured to convert the original data into numerical data and obtain a random noise vector, generate a fake data sample based on a generative adversarial network (GAN), and input the fake data sample and a real data sample as input data;

[0049] The attack discrimination module is configured to optimize a discrimination model based on an extreme learning machine and discriminate attack data based on the input data;

[0050] The model construction module is configured to construct a security posture model based on a hidden Markov model and optimize parameters based on a swarm particle algorithm.

[0051] The security prediction module is configured to output a predicted security posture based on real-time attack data.

[0052] The path prediction module is configured to input the predicted security posture into a deep Q learning network and combine a double deep Q network to predict an attack path, and adjust a defense strategy in real time based on a predicted attack path graph.

[0053] In a third aspect, the present application provides a computer device, comprising a memory and a processor, and the memory stores a computer program, wherein the computer program is executed by the processor to implement any step of the data security management method based on the cloud computing platform according to the first aspect of the present application.

[0054] In a fourth aspect, the present application provides a computer readable storage medium, which stores a computer program, wherein the computer program is executed by a processor to implement any step of the data security management method based on the cloud computing platform according to the first aspect of the present application.

[0055] The present application has the following beneficial effects: the generative adversarial network and the extreme learning machine are used to optimize the discrimination model, the discrimination accuracy of the attack data is effectively improved, the hidden Markov model is used to establish the security posture model, the swarm particle algorithm is used to optimize the model parameters, the predicted attack path is combined with the deep Q learning network, the double deep Q network is used to predict the attack path, and the defense strategy is adjusted in real time. BRIEF DESCRIPTION OF DRAWINGS

[0056] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0057] Figure 1 The flowchart of the data security management method based on the cloud computing platform in embodiment 1.

[0058] Figure 2A schematic diagram of the data security management system based on the cloud computing platform in Example 1. DETAILED DESCRIPTION

[0059] In order to make the above objectives, features and advantages of the present application more apparent, specific embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0060] In the following description, a lot of specific details are set forth in order to facilitate a full understanding of the present application, but the present application can also be implemented in other ways different from those described herein, and those skilled in the art can make similar generalizations without departing from the spirit of the present application, so the present application is not limited to the specific embodiments disclosed below.

[0061] Secondly, the "one embodiment" or "embodiment" referred to herein means that the specific features, structures or characteristics can be included in at least one implementation of the present application. "In one embodiment" appearing in different places in the specification does not mean the same embodiment, nor is it an embodiment that is separate or alternative to other embodiments.

[0062] Example 1, with reference to Figure 1 and Figure 2 , the first embodiment of the present application provides a data security management method based on a cloud computing platform, comprising the following steps:

[0063] S1, real-time acquisition of raw data of the cloud computing platform and pre-processing;

[0064] Specifically, real-time acquisition of raw data of the cloud computing platform and pre-processing includes:

[0065] Each device (physical node or virtual node) in the cloud computing platform is regarded as a node, and a collection tool is used to collect raw data of each node in the cloud computing platform in real time;

[0066] The collection tool includes scanning the security vulnerability data of each node using a security vulnerability scanning tool (such as Nessus, OpenVAS), obtaining the node basic information of each node through a network topology discovery tool (such as Nmap, NetBrain), and obtaining the device configuration log through the management tool of the cloud computing platform (such as AWS CloudWatch, Azure Monitor);

[0067] The raw data includes security vulnerability data (such as system vulnerability, service vulnerability, application vulnerability), node basic information (such as device type, operating system, running service, network configuration, etc.), and device configuration log (such as recording the hardware status, load, CPU usage, memory occupancy of the device);

[0068] The preprocessing includes deduplication of the collected raw data, deletion of duplicate records, for example, if the same user performs the same operation multiple times at the same time point, one record is retained, the mean interpolation method is used for interpolation of numerical data (such as virtual machine resource values, network traffic size), and the standard deviation method is used to detect outliers and eliminate them.

[0069] The existing cloud computing platform security management system usually relies on static security data or only protects known attack features, ignoring the dynamics and changes of data. By using real-time collection tools such as security vulnerability scanning tools (Nessus, OpenVAS), network topology discovery tools (Nmap, NetBrain) and cloud platform management tools (AWSCloudWatch, Azure Monitor), the present application can collect real-time data from each node (physical node or virtual node) of the cloud computing platform, including security vulnerability data, node basic information, device configuration logs, etc. This multi-angle real-time data collection enhances the response capability to complex attacks, can obtain comprehensive information in a shorter time and perform accurate preprocessing, ensuring the accuracy and reliability of the subsequent discrimination model and prediction model. The current system mostly relies on manual configuration rules to capture attack patterns, while the present application realizes real-time and comprehensive perception of the cloud platform state through automatic collection of diversified data sources, effectively solving the problem of insufficient detection of new attack patterns.

[0070] S2, converting the original data into numerical data and obtaining a random noise vector, constructing a discrimination model based on a generative adversarial network (GAN) to generate fake data samples, and using the real data samples as input data;

[0071] Specifically, converting the original data into numerical data and obtaining a random noise vector, constructing a discrimination model based on a generative adversarial network (GAN) to generate fake data samples, and using the real data samples as input data includes:

[0072] Extracting features from the preprocessed original data, converting text and category data in the features into numerical data through one-hot encoding, hashing and direct numericalization, and standardizing the numerical data;

[0073] Using standard normal distribution sampling to obtain a random noise vector of the numerical data, and using the random noise vector as input of a generative adversarial network (GAN) generator;

[0074] Initializing the weight parameters of the generator and discriminator of the generative adversarial network and The random noise vector is input into the generator to generate a fake data sample, the data sample is input into the discriminator, and a discrimination value is output, which represents the probability that the data sample is a real data sample;

[0075] The generator is a deep neural network model, the input of which is a random noise vector, and the output is a fake data sample (such as fake attack data), and the weight parameters of the generator are initialized;

[0076] The discriminator is a binary classification neural network, which is used to determine whether the input data is real network traffic (real data distribution) or fake data generated by the generator (generated data distribution), and the weight parameters of the discriminator are initialized;

[0077] The loss function of the discriminator is defined and the loss function of the generator The optimization goal of the discriminator is to maximize the loss function, that is, to maximize the recognition accuracy of real data samples and minimize the recognition errors of fake data samples, and the optimization goal of the generator is to minimize the loss function, which is used to minimize the probability that the generated data samples are identified as fake data by the discriminator, that is, to make it difficult for the discriminator to distinguish between generated data and real data, and the loss function is:

[0078] ,

[0079] ,

[0080] wherein, is the expected value, and represent the average loss of real data samples and random noise vectors on real data distribution and fake data distribution respectively, the distribution is a normal distribution, represents the discrimination value of the discriminator for real data samples , represents the discrimination value of the discriminator for fake data samples ;

[0081] According to actual requirements, the number of training rounds is preset, the generator and the discriminator are repeatedly trained alternately until the preset number of training rounds is reached, a fake data sample is generated by inputting a random noise vector into the trained generative adversarial network, and real data samples and fake data samples are input into the discriminator as input data.

[0082] The alternately training the generator and the discriminator includes fixing the weight parameters of the generator and updating the weight parameters of the discriminator According to the loss function, the gradient is calculated using the back propagation algorithm, and the weight parameters of the discriminator are updated , and the weight parameters of the discriminator are fixed , the weight parameters of the generator are updated According to the loss function, the gradient is calculated using the back propagation algorithm, and the weight parameters of the generator are updated .

[0083] The traditional security system adopts static rules or feature-based discrimination method, which is easy to be bypassed by new and unknown attack patterns, and the application establishes a discrimination model through a generative adversarial network (GAN), compares and trains the generated fake attack data samples with the real data samples, further improves the accuracy of the discrimination model, and the generator generates fake data to enhance the diversity of the training data, so that the discriminator can effectively distinguish between real data and fake data, thereby improving the detection ability of abnormal attack behavior, and the traditional system only relies on rule library for attack recognition, and the application generates fake data similar to attack behavior through GAN to train the model, so that the system can recognize new attacks without explicit rules, which greatly enhances the adaptability and intelligence of the system, and has high ability to cope with unknown attacks.

[0084] S3, optimizing the discrimination model based on extreme learning machine and discriminating attack data based on input data

[0085] Specifically, optimizing the discrimination model based on extreme learning machine and discriminating attack data based on input data includes:

[0086] Each group of input data of the discriminator is regarded as a sample, the weight and bias of each hidden layer node in the extreme learning machine are randomly initialized, the input data of the discriminator is transmitted to each hidden layer node through the randomly initialized weight and bias, and the activation function is applied to generate hidden layer output, all samples are calculated, and a hidden layer output matrix is constructed wherein each row represents the hidden layer activation output of a sample, and the hidden output matrix is:

[0087] ,

[0088] wherein, represents a Sigmoid activation function, represents the weight of a hidden layer node, represents the total number of hidden layer nodes, represents the bias of a hidden layer node, represents an input sample, represents the total number of samples

[0089] In order to protect the cloud computing platform from potential attacks, it is necessary to identify attack behaviors in a timely and accurate manner. The extreme learning machine optimizes the input data to enable the discriminator to more accurately identify attack data. Through model training, the extreme learning machine can not only make accurate judgments on known attack patterns, but also effectively identify new attack patterns. As attack methods continue to evolve, the discriminant model also needs to be continuously optimized. The extreme learning machine has the ability to quickly adjust and can update in real time according to newly collected attack data, ensuring the efficiency and accuracy of the model and providing the cloud computing platform with dynamic and adaptive attack discrimination capabilities.

[0090] Calculate the loss function of all samples That is, the difference between the predicted output of each sample and the target output. The loss function is:

[0091] ,

[0092] Wherein, represents the output weight of the hidden layer node , represents the weight of the hidden layer node , represents the input sample , represents the bias of the hidden layer node , represents the target output (i.e. real label) of the input sample , which is usually normal traffic or attack data, obtained by manually labeling network traffic data by humans;

[0093] Using the gradient descent method, adjust the value of the output weight to minimize the loss function. By solving the minimized loss function, the final output weight is obtained. If the hidden output matrix is not invertible (usually when the number of training samples is greater than the number of hidden layer nodes), the generalized inverse matrix is used to solve it.

[0094] Initialize the discriminant model using the final output weight . By inputting the input data into the discriminant model, set the discriminant threshold according to the discriminant value output by the discriminator, and discriminate the attack data. If the discriminant value is greater than the discriminant threshold, it indicates that the input data is real data, otherwise, it indicates that the input data is attack data.

[0095] The extreme learning machine can quickly train the neural network, greatly reduces the training time, adopts the random initialization of the weight of the input layer, directly calculates the weight of the output layer by using a simple mathematical method, thereby a large number of calculation steps in the traditional neural network training are omitted, in the face of large-scale data, compared with the traditional neural network, there is a significant advantage, in the security detection task of the cloud computing platform, the data quantity is usually very large (including node information, vulnerability data, configuration log and the like), the extreme learning machine can process the large-scale data while ensuring the accuracy, so that the training and updating are more efficient;

[0096] The discriminator is trained for multiple rounds, the output weight is updated using new input data in each round, after each training, the incremental learning is performed on the extreme learning machine according to the new input data, the output weight is dynamically updated, the adaptability of the discriminator to new attacks is ensured, the performance of the discriminator is evaluated through cross-validation, if the detection accuracy does not reach the expectation, the learning rate, the number of nodes of the hidden layer, the activation function, the batch size and the like are adjusted to optimize the discriminator.

[0097] The traditional discrimination method (such as a neural network and a support vector machine) usually needs a long time in the training process, and the processing efficiency is low when complex data is processed, by introducing the extreme learning machine (ELM), the purpose of fast training and optimizing the discrimination model is realized, the ELM can avoid the back propagation calculation in the traditional neural network by randomly initializing the weight and bias of the hidden layer node, so that the training speed is greatly improved, and a good generalization effect can be achieved without relying on a large-scale data set, the traditional discrimination method is usually low in processing efficiency when facing large-scale data, and by using the ELM, the training speed and real-time response capability of the discrimination process are greatly improved, so that the security protection of the cloud computing platform can timely adapt to and cope with high-frequency attacks.

[0098] S4、 using a hidden Markov model to construct a security posture model and optimizing parameters through a swarm particle algorithm, and outputting a predicted security posture based on real-time attack data;

[0099] Specifically, using a hidden Markov model to construct a security posture model and optimizing parameters through a swarm particle algorithm, and outputting a predicted security posture based on real-time attack data includes:

[0100] The security posture of the cloud computing platform is defined as a Markov process, the hidden state is defined as the security posture of all nodes in the cloud computing platform (for example, normal, abnormal and under attack), a hidden Markov model is used to construct a security posture model, the parameters of the security posture model are initialized, and the parameters include a transition probability matrix, an observation probability matrix and an initial state distribution;

[0101] The sum of the elements of each row in the transition probability matrix is 1, and each element represents the probability of the cloud computing platform transitioning from one hidden state to another hidden state;

[0102] The sum of the elements of each row in the observation probability matrix is 1, and each element describes the probability of observing a certain observation value under each hidden state;

[0103] The initial state distribution defines the probability of the cloud computing platform being in a certain hidden state at the beginning;

[0104] The hidden Markov model is suitable for describing the tool for the transition of the system between different states, especially when dealing with dynamic systems, the security posture of the cloud computing platform changes over time, which may be caused by normal operation, abnormal behavior or attack activity, which can effectively model this dynamic process and describe the transition of the platform from one security posture to another (such as from normal to abnormal, or from abnormal to attack state), in this process, the hidden state of the platform (such as normal, abnormal, attack) will change dynamically, by establishing a state transition probability model, the security posture can be effectively tracked and predicted, in the cloud computing platform, the hidden state may not be directly observable, but through the observed data (such as traffic patterns, system logs, etc.) the hidden state can be inferred, which is crucial for security posture modeling, because it helps to detect potential security problems;

[0105] The optimization of parameters by the swarm particle algorithm includes initializing the initial position and initial speed of each particle in the particle swarm using random numbers, each particle represents a solution vector, the initial position of the particle represents a guess of the parameters of the security posture model, the speed of each particle represents the speed of the particle in the search space, which is the magnitude of adjusting the parameters, according to the actual demand, the size of the particle swarm is selected, usually the number of particles is between dozens to hundreds, too many particles will increase the computational burden, and too few particles may lead to insufficient search space;

[0106] Use K-means clustering to divide the particle swarm into multiple clusters, each cluster represents a local optimal solution area, avoid the particle swarm from falling into local optimal solution, improve the overall search efficiency, and perform independent fitness evaluation on the particles in each cluster, the particles in the cluster share a common best position (i.e. the global optimal solution in the cluster);

[0107] Each particle is trained by using the Baum-Welch algorithm, which is an EM (Expectation Maximization) algorithm for estimating the parameters of a model given the observed data, in each iteration, the forward variable and the backward variable are calculated by the E-step (forward-backward algorithm), and the expected value of the transition probability of each pair of hidden states is calculated, the transition probability and the observation probability are updated by using the expected value by the M-step, the E-step and the M-step are repeated until the parameters of the hidden Markov model converge or the maximum number of iterations is reached;

[0108] The forward variable represents the probability of reaching the hidden state at a certain time point from the initial state;

[0109] The backward variable represents the probability of reaching the terminal state from a certain time point;

[0110] After each particle is trained, the error value is calculated using the validation data set, the fitness of each particle is calculated by the fitness function, and the position and velocity of the particle are updated according to the velocity adjustment formula, the fitness of each particle is used as the basis for adjusting the position and velocity of the particle in the next step, and the fitness function is:

[0111] ,

[0112] Wherein, represents the fitness of the particle , represents the quality of the solution, the greater the value, the better the solution, represents the error value of the particle , using the mean square error measurement;

[0113] According to the position update and velocity adjustment of the particle, the fitness of the particle is re-evaluated, the new position of each particle corresponds to a new solution, the fitness of all particles is compared, the particle with the maximum fitness is selected as the global optimal particle, and the global optimal position is updated;

[0114] The global optimal particle is selected as the final parameter of the security situation model;

[0115] The particle swarm optimization algorithm can effectively avoid the problem of local optimal solution, for parameter optimization in security situation modeling, using PSO can help find the optimal model parameters, thereby improving the prediction ability and generalization ability of the model, the transition probability matrix, the observation probability matrix and the initial state distribution in the hidden Markov model are the key to the performance of the model, through the particle swarm optimization algorithm, these parameters can be optimized, thereby improving the prediction ability of the hidden Markov model for the security situation of the cloud computing platform, the PSO algorithm simulates the flight and exploration of particles in the search space, which can find the optimal solution in a larger range, thereby avoiding falling into a local optimal solution, ensuring that the global optimal parameters are found, and further improving the accuracy of the model;

[0116] The attack data of different time steps is taken as an observation sequence, a Viterbi algorithm is used to decode an optimal hidden state sequence, a probability of an initial state is initialized, a maximum probability of each hidden state is recursively propagated for each time step and each hidden state in the observation sequence, and a most possible hidden state sequence is found by recording a maximum probability source in each time step through a backtracking process;

[0117] The performance of the security posture model is detected by evaluating a log likelihood value of the model, and the model parameters are fine-tuned according to the log likelihood value and other performance evaluation indexes (such as accuracy, recall rate, etc.), so as to improve the accuracy of the security posture prediction;

[0118] The change of the security posture is real-time, and may fluctuate with the evolution of attack means and the change of system state. The hidden Markov model combined with the swarm particle optimization can accurately predict the security posture of the platform, provide an effective decision basis for the system administrator, and timely discover potential threats. Through the combination of the hidden Markov model and the particle swarm optimization algorithm, the dynamic change of the security posture of the platform can be captured, and the future state can be predicted. Before the attack occurs, the model can predict the potential attack posture, and respond in advance. The attack means of the attacker is constantly updated, so a flexible prediction model is needed. The hidden Markov model can adapt to the changing attack mode and environment through continuous learning and parameter adjustment, so as to improve the prevention ability of new attacks;

[0119] The real-time attack data is substituted into the security posture model to output a predicted security posture.

[0120] Accurate prediction of the security posture is an indispensable part of protection of the cloud computing platform. Existing methods usually use static models or rule-based systems, which are difficult to dynamically predict and adapt to changing attack paths. The present application adopts a hidden Markov model (HMM) to construct a security posture model, combines a swarm particle algorithm to optimize model parameters, and further improves the prediction ability of the model for the security posture through the iterative training of the parameters by the Baum-Welch algorithm. The HMM model can accurately evaluate the security state of the cloud platform in multi-step prediction, thereby providing a reliable basis for attack path prediction and defense strategy adjustment. Through the combination of the HMM and the swarm particle algorithm, the present application solves the problems of poor dynamic adaptability and lack of real-time early warning capability in traditional methods, so that the cloud computing platform can effectively cope with the changing attack posture and timely adjust the defense strategy.

[0121] S5, substituting the predicted security posture into a deep Q learning network and combining a double deep Q network to predict an attack path, and adjusting a defense strategy in real time based on a predicted attack path graph;

[0122] Specifically, substituting the predicted security posture into the deep Q learning network comprises:

[0123] define state space and action space , in order to improve the generalization ability and intelligent level of the system, using MulVAL to generate the attack path graph between nodes in the cloud computing platform and integrate the state space ;

[0124] Attack path prediction is the core part of the defense system, by using MulVAL to generate attack path graph, can help the agent to simulate the behavior of the attacker, so as to predict the possible attack path in advance, through understanding the attack path, can be targeted to deploy defense strategy, reduce the possibility of attack success;

[0125] the state space including the predicted security posture as a component of the state space, the state space expression is:

[0126] ,

[0127] wherein, respectively represent the security vulnerability data (such as system vulnerability, service vulnerability, application vulnerability), node basic information (such as device type, operating system, running service, network configuration, etc.), device configuration log (such as recording the hardware state, load, CPU usage, memory occupancy) and predicted security posture at time point ;

[0128] Whenever the input data changes, the state space is updated at the same time, through the agent according to the change of state space in the environment to adjust its action in real time, if the security vulnerability data in the state space changes, the agent quickly adapts to the new attack mode, and predicts the corresponding attack path or defense strategy;

[0129] the MulVAL refers to a tool and language for multi-stage vulnerability analysis and attack path prediction, by extracting and converting the attack path from MulVAL graph into numerical features, the risk degree of these paths, the importance of nodes and the success probability of the path as a part of state vector, for example, if the path passes through a plurality of high-risk nodes, the risk value of the path can be set to be higher, reflecting to the agent;

[0130] the action space including in order to realize the goal of attack path prediction and defense strategy optimization, according to the possible attack mode and defense measures in the cloud computing platform environment to define the action space, the action space expression is:

[0131] ,

[0132] where, represents local exploit, remote attack, lateral movement, firewall rule adjustment, traffic limitation, source IP blocking, respectively;

[0133] The final goal of setting the action space is to let the intelligent agent optimize the attack path prediction through the deep Q learning model, and adjust the defense strategy accordingly.

[0134] The traditional security protection method often relies on manually configured defense rules, and when facing complex attack paths and real-time changing security conditions, the protection effect is poor. By introducing deep Q learning (DQL) and double deep Q network (DDQN), the invention realizes intelligent attack path prediction and defense strategy optimization. DQL can train intelligent agents through real-time attack data, so that they can gradually learn how to deal with various attack modes. DDQN combines the Q value update mechanism and the target network, effectively solving the overestimation problem in traditional Q learning, thereby improving the accuracy of attack path prediction and the real-time adjustment ability of defense strategy. Traditional defense methods are difficult to adaptively adjust defense strategies, while by introducing deep reinforcement learning (DQL and DDQN), the invention realizes the ability of real-time learning and automatic adjustment, so that the system can quickly learn and optimize strategies when facing unknown attacks, improving the security and adaptive ability of the platform.

[0135] Furthermore, in combination with the double deep Q network for attack path prediction, the real-time adjustment of the defense strategy based on the predicted attack path graph includes:

[0136] The deep Q learning network is used as the initial Q network, and the double deep Q network (DDQN) is used as the target Q network.

[0137] Initialize the initial Q network and the target Q network, and create a deep neural network represents the initial Q network, wherein represents the parameters of the initial Q network, and a double deep Q network is created , wherein represents the parameters of the target Q network, and at the time of initialization

[0138] The intelligent agent will evaluate all actions in the action space according to the current state space at each time point , through -greedy strategy to balance exploration and utilization, -greedy strategy helps the intelligent agent to explore more at the early stage of training, and to utilize the knowledge learned at the later stage of training, the intelligent agent selects the action with the maximum current Q value (utilization) with a probability of , and selects the action with the maximum exploration value (exploration) with a probability of probabilistically selecting a random action (exploration), wherein an exploration rate representing a probability of the agent selecting a random action, which is gradually reduced through a preset exploration rate as the training proceeds, so as to increase a probability of the agent using a known strategy;

[0139] defining a reward function according to the nodes The reward function includes a new node reward, a control network node reward and a collected credential reward, which are used to quantify the return obtained by the agent when selecting a specific attack path or defense strategy, and the formula is:

[0140] ,

[0141] wherein, represents a reward value obtained by the agent when performing an action at a time point , , , respectively represent weight coefficients of each reward item, , , respectively represent the new node reward, the control network node reward and the collected credential reward;

[0142] The new node reward refers to setting key nodes (such as management nodes and database nodes) in the cloud computing platform according to actual needs. Whenever the agent selects an attack path to successfully reach a new node, the agent will give a reward according to the criticality of the discovered node according to the network topology and the complexity of the attack path. If the node is a key node, the reward value will be increased, otherwise, the reward value will be reduced. For example, if the agent selects an attack path and discovers a server containing sensitive data, the reward value will be increased, and if a non-essential routing node is discovered, the reward value will be reduced.

[0143] The control network node reward refers to the control state of a node changing whenever the agent successfully attacks and controls the node. The agent gives a reward according to the importance of the node and the influence on the subsequent attack path. If a key node is controlled, the reward value will be increased, otherwise, the reward value will be reduced. For example, if the agent controls a host and successfully uses the host as a stepping stone for subsequent attacks, the reward value will be increased, and if a low-value node (such as a peripheral device) is controlled, the reward value will be reduced.

[0144] The collection credential reward refers to that the reward value is increased whenever the agent successfully collects important credentials (such as administrator password, database connection information, etc.), and the collection of credentials is usually associated with the success rate of the attack target and the complexity of the attack path, if important credentials are collected, the reward value is increased, if ordinary credentials are collected, the reward value is decreased, for example, if the agent successfully obtains the administrator credentials and controls the high-value network resources, the reward value is higher, if only the credentials of a non-critical user are obtained, the reward value is lower;

[0145] The target Q value is calculated using the target Q network , the next optimal action is selected, and the formula is:

[0146] ,

[0147] Wherein, represents the reward value obtained by the agent at time point when performing the action, represents the discount factor, which controls the degree of influence of future rewards, represents the next state space in the target Q network, the action with the maximum Q value is selected,

[0148] After performing an action, the agent updates the Q value through the difference between the current Q value and the target Q value, and the formula is:

[0149] ,

[0150] Wherein, represents the Q value of the initial Q network in the state space selecting the action , represents the learning rate, which determines the influence of new data on the update of the Q value;

[0151] Through multiple training and Q value updates, the agent will be able to more accurately select attack paths and defense measures, thereby improving the prediction and defense effect;

[0152] The parameters of the initial Q network are updated to the target Q network regularly;

[0153] Deep Q learning can optimize the decision-making process of the agent in a complex environment, and DDQN further solves the overestimation problem that may exist in the standard DQN, by combining these methods, the agent can continuously improve the prediction of the attack path, adjust the defense strategy in real time, and improve the defense effect;

[0154] Based on the attack path graph generated by MulVAL, the agent preferentially evaluates each possible attack path and selects the path that maximizes the reward, and this process relies on the Q value update of DDQN, so that the agent can adaptively select the optimal path during the training process, and by analyzing the attack path in real time, the agent adjusts the defense strategy in real time.

[0155] The present application combines various intelligent algorithms such as generative adversarial networks (GAN), extreme learning machines (ELM), hidden Markov models (HMM) and deep Q learning (DQL) to form a multi-level defense mechanism, each technical module is complementary, from data collection, attack prediction to defense strategy adjustment, forming a perfect security protection system. Compared with existing single defense technology, this multi-technology fusion method can improve the protection effect from multiple dimensions, so that the system can cope with complex attack patterns and variable security threats. Traditional systems usually rely on a single defense mechanism, while the present application significantly improves the overall intelligence level and accuracy of security protection through a multi-level intelligent defense system, and can better cope with complex attack paths and dynamic attack patterns.

[0156] The present embodiment also provides a data security management system based on a cloud computing platform, comprising:

[0157] A data acquisition module for real-time acquisition and preprocessing of raw data of the cloud computing platform;

[0158] A noise generation module for converting the raw data into numerical data and obtaining a random noise vector, constructing a discriminant model based on a generative adversarial network (GAN) to generate fake data samples, and inputting the fake data samples and real data samples as input data;

[0159] An attack discrimination module for optimizing the discriminant model based on an extreme learning machine using the input data and discriminating attack data;

[0160] A model construction module for constructing a security posture model using a hidden Markov model and optimizing parameters through a swarm particle algorithm;

[0161] A security prediction module for outputting a predicted security posture based on real-time attack data;

[0162] A path prediction module for substituting the predicted security posture into a deep Q learning network and combining a double deep Q network to predict an attack path, and adjusting a defense strategy in real time based on the predicted attack path graph.

[0163] The embodiment also provides a computer device suitable for the data security management method based on the cloud computing platform, including a memory and a processor; the memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions to realize the data security management method based on the cloud computing platform proposed in the above embodiment.

[0164] The computer device can be a terminal, and the computer device includes a processor, a memory, a communication interface, a display screen and an input device connected through a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The communication interface of the computer device is used to communicate with external terminals in a wired or wireless manner. The wireless manner can be achieved through WIFI, an operator network, NFC (Near Field Communication) or other technologies. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer overlaid on the display screen, or a key, a trackball or a touchpad arranged on the shell of the computer device, or an external keyboard, a touchpad or a mouse, etc.

[0165] The embodiment also provides a storage medium having a computer program stored thereon, the program being executed by a processor to realize the data security management method based on the cloud computing platform proposed in the above embodiment. The storage medium can be realized by any type of volatile or non-volatile storage device or a combination thereof, such as a static random access memory (SRAM), an electrically erasable programmable read-only memory (EEPROM), an erasable programmable read-only memory (EPROM), a programmable read-only memory (PROM), a read-only memory (ROM), a magnetic storage, a flash memory, a magnetic disk or an optical disk.

[0166] It should be noted that the above examples are only used to illustrate the technical solutions of the present application but not limit the present application. Although the present application is described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or equivalently replaced, without departing from the spirit and scope of the technical solutions of the present application, which should be covered in the scope of the claims of the present application.

Claims

1. A data security management method based on a cloud computing platform, characterized in that: include: Real-time acquisition and preprocessing of raw data from the cloud computing platform; The raw data includes security vulnerability data, basic node information, and device configuration logs. The original data is converted into numerical data and a random noise vector is obtained. A discriminant model is built based on the generative adversarial network (GAN) to generate fake data samples. These fake data samples are used as input data along with real data samples. The discriminant model is optimized using the input data based on the extreme learning machine and the attack data is identified. A security posture model is constructed using a hidden Markov model and the parameters are optimized using a clustered particle algorithm. The security posture is predicted based on real-time attack data. The predicted security situation is fed into a deep Q-learning network and combined with a dual deep Q-network to predict attack paths. Based on the predicted attack path graph, the defense strategy is adjusted in real time. The process of constructing a security posture model using a Hidden Markov Model and optimizing parameters using a swarm particle algorithm, and then predicting the security posture based on real-time attack data, includes: The security posture of a cloud computing platform is defined as a Markov process, and the hidden state is defined as the overall security posture of all nodes in the cloud computing platform. A security posture model is constructed using a hidden Markov model, and the parameters of the security posture model are initialized. The parameter optimization using the swarm particle algorithm includes initializing the initial position and initial velocity of each particle in the swarm with random numbers and selecting the size of the swarm. K-means clustering is used to divide the particle swarm into multiple clusters, each cluster representing a local optimum region. The fitness of particles in each cluster is evaluated independently, and particles within a cluster share a common optimal position. The fitness of each particle is calculated using a fitness function. The particle's position and velocity are updated according to the velocity adjustment formula. Based on the updated position and velocity of the particle, the particle's fitness is re-evaluated. Each particle's new position corresponds to a new solution. The fitness of all particles is compared, and the particle with the highest fitness is selected as the globally optimal particle. The globally optimal position is then updated. The globally optimal particle is selected as the parameter for the final security situation model; Attack data at different time steps are used as observation sequences. The Viterbi algorithm is used to decode the optimal hidden state sequence and initialize the probability of the initial state. For each time step and each hidden state in the observation sequence, the maximum probability of each hidden state is recursively calculated. The most likely hidden state sequence is found by recording the source of the maximum probability in each time step through a backtracking process. The performance of the security situation model is detected by evaluating the log-likelihood value of the model, and the model parameters are fine-tuned based on the log-likelihood value and other performance evaluation indicators. By feeding real-time attack data into the security posture model, the predicted security posture is output.

2. The data security management method based on a cloud computing platform as described in claim 1, characterized in that: The process of converting the original data into numerical data and obtaining a random noise vector, constructing a discriminative model based on a Generative Adversarial Network (GAN) to generate fake data samples, and using real data samples as input data includes: Extract features from the preprocessed raw data, transform textual and categorical data in the features into numerical data, and standardize them; Random noise vectors of numerical data are obtained by sampling using a standard normal distribution and used as input to a generative adversarial network generator. Initialize the weight parameters of the generator and discriminator of the generative adversarial network. and The random noise vector is input into the generator to generate fake data samples, and the data samples are input into the discriminator to output the discriminant value. Define the loss function of the discriminator Loss function of generator The discriminator's optimization objective is to maximize the loss function. The generator and discriminator are trained alternately and repeatedly until the preset number of training rounds is reached. By inputting random noise vectors into the trained generative adversarial network, fake data samples are generated. Real data samples and fake data samples are then used as input data to the discriminator.

3. The data security management method based on a cloud computing platform as described in claim 2, characterized in that: The method of optimizing the discrimination model based on input data and discriminating attack data using extreme learning machine includes: Each set of input data for the discriminator is treated as a sample. The weights and biases of each hidden layer node in the extreme learning machine are randomly initialized. The input data of the discriminator is passed to each hidden layer node through the randomly initialized weights and biases, and an activation function is applied to generate the hidden layer output. The hidden layer output matrix is ​​constructed by calculating the output of all samples. ; Calculate the loss function for all samples Using gradient descent, the output weights are adjusted. The values ​​are minimized by the loss function, and the final output weights are obtained by solving the minimized loss function. ; Use the final output weights Initialize the discrimination model by inputting input data into the discrimination model. Based on the discrimination value output by the discriminator, set a discrimination threshold to discriminate attack data. If the discrimination value is greater than the discrimination threshold, it means that the input data is real data; otherwise, it means that the input data is attack data. The discriminator is trained in multiple rounds, with the output weights updated using new input data in each round. After each training round, the extreme learning machine is used for incremental learning based on the new input data to dynamically update the output weights.

4. The data security management method based on a cloud computing platform as described in claim 3, characterized in that: The process of incorporating the predicted security situation into the deep Q-learning network includes: Define the state space and action space MulVAL is used to generate attack path graphs between nodes in a cloud computing platform and integrate them into the state space. .

5. The data security management method based on a cloud computing platform as described in claim 4, characterized in that: The method of combining dual deep Q-networks for attack path prediction and adjusting the defense strategy in real time based on the predicted attack path graph includes: A deep Q-learning network is used as the initial Q-network, and a dual deep Q-network is used as the target Q-network. Initialize the initial Q-network and the target Q-network to create a deep neural network. Denotes the initial Q-network, where The parameters of the initial Q-network are used to create a dual-depth Q-network. ,in These represent the parameters of the target Q-network; The agent will at each time point Based on the current state space Assess the action space All actions, through -Greedy strategy balances exploration and exploitation, the agent uses Probably select the action with the highest current Q value, in order to Probability of choosing a random action, where The exploration rate represents the probability that an agent will choose a random action; Define the reward function based on the node. The reward function includes new node rewards, network control node rewards, and credential collection rewards; Calculate the target Q value using the target Q-network. The agent selects the next optimal action. After executing an action, the agent updates the Q value based on the difference between the current Q value and the target Q value. Periodically update the parameters of the initial Q network to the target Q network; Based on the attack path graph generated by MulVAL, the agent prioritizes the evaluation of each possible attack path and selects the path that maximizes the reward. By analyzing the attack paths in real time, the agent adjusts its defense strategy in real time.

6. The data security management method based on a cloud computing platform as described in claim 1, characterized in that: The preprocessing includes deduplicating the collected raw data, deleting duplicate records, interpolating numerical data using mean interpolation, and detecting and removing outliers using standard deviation.

7. A cloud computing platform-based data security management system based on the data security management method for cloud computing platforms according to any one of claims 1-6, characterized in that: include: The data acquisition module is used to collect raw data from the cloud computing platform in real time and perform preprocessing. The noise generation module is used to convert the original data into numerical data and obtain random noise vectors. It builds a discriminative model based on the generative adversarial network (GAN) to generate fake data samples and uses real data samples as input data. The attack detection module is used to optimize the detection model based on the input data and detect attack data using the extreme learning machine. The model building module is used to build a security situation model using a Hidden Markov Model and optimize the parameters using a swarm particle algorithm. The security prediction module is used to predict the security posture based on real-time attack data output. The path prediction module is used to input the predicted security situation into the deep Q-learning network and combine it with a dual deep Q-network to predict attack paths, and adjust the defense strategy in real time based on the predicted attack path graph.

8. A computer device, comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, it implements the steps of the data security management method based on a cloud computing platform as described in any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, it implements the steps of the data security management method based on the cloud computing platform as described in any one of claims 1 to 6.

Images