A cloud computing-based information security evaluation method and system, a computer device, and a storage medium

Abstract

The application discloses a kind of information security evaluation method and system based on cloud computing, it is related to information security technical field, including, acquisition multi-modal data, adopt node identifier to generate space-time data package by encryption;Through edge node, threat characteristics are aggregated using secure multiparty computation, construct 58-dimensional square matrix, construct risk assessment model based on quantum heuristic algorithm, apply Do-Calculus algorithm to locate root cause threat, federal reinforcement learning dynamically optimizes model weight, output threat vector to cloud causal engine;Combine threat intelligence to construct space-time causal diagram, apply Do-Calculus algorithm to locate root cause threat, generate dynamic defense strategy, KL divergence constraint optimization access control, and store strategy execution log in local encryption, generate evaluation audit log.The method disclosed in the application solves the problem of insufficient correlation of cloud computing multi-modal data, defense lag and verification fault, and realizes the coordinated breakthrough of evaluation accuracy and response efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and in particular to an information security evaluation method and system based on cloud computing. BACKGROUND

[0002] The current information security evaluation of cloud computing environment generally adopts a detection mechanism combining rule matching and static model, such as pattern recognition of log events based on a pre-defined threat feature library or triggering an alarm through a fixed threshold. Sensitive data desensitization relies on regular expressions to uniformly mask IP addresses, user identities and other fields, and encrypted transmission uses a single algorithm combined with a periodic key rotation strategy. Vulnerability scanning tools need to rely on offline updated feature libraries to match known attack signatures. Such methods can partially meet the needs in a static resource allocation scenario, but in the face of a cloud-native dynamic environment, static rules are difficult to adapt to the real-time changing attack surface, resulting in rising detection delay and missed detection rate of zero-day attacks. In addition, traditional classification models cannot capture the nonlinear correlation features of API access timing and resource consumption in microservice call chains, resulting in frequent false positives and missed detections.

[0003] Existing technologies are mostly based on linear statistical methods to construct threat correlation networks or use traditional clustering algorithms to divide risk patterns. Threat levels are divided by correlating protocol types and the number of login failures, or attack paths are inferred using Bayesian networks. However, linear models are insufficient in representing cross-layer service dependency relationships, leading to misjudgment of threat propagation paths; static causal reasoning frameworks fail to quantify the evolution of root threats with resource elasticity scaling due to the lack of spatio-temporal dynamic characteristics. At the same time, traditional encryption mechanisms increase computational overhead and are difficult to resist side-channel attacks due to rigid key rotation strategies and multi-tenant data isolation defects, further restricting the security performance of cloud platforms. SUMMARY

[0004] In view of the above existing problems, the present application is proposed.

[0005] Therefore, the present application provides an information security evaluation method based on cloud computing to solve the problems of insufficient spatio-temporal feature correlation and lagging dynamic defense strategy generation in multi-modal threat evaluation.

[0006] To solve the above technical problems, the present application provides the following technical solutions:

[0007] In a first aspect, the present application provides an information security evaluation method based on cloud computing, which includes,

[0008] Collecting multi-modal data, performing local desensitization processing on the multi-modal data through a trusted execution environment, adding spatio-temporal labels, and using node unique identifiers for symmetric encryption and asymmetric negotiation for encryption to generate spatio-temporal data packets;

[0009] Through the edge node federated learning architecture, threat features are aggregated by secure multi-party computation, the desensitized multi-modal data in the space-time data packet is mapped into a standardized feature vector, and a multi-modal threat matrix is constructed;

[0010] Based on a quantum heuristic algorithm, a risk assessment model is constructed, encrypted gradients of edge nodes are aggregated through a federated reinforcement learning architecture, a threat feature vector is output to a cloud causal reasoning engine, a space-time causal graph is constructed in combination with a threat intelligence library, a root cause threat is located by applying a Do-Calculus algorithm, and a dynamic defense strategy is generated;

[0011] Based on the edge node, the dynamic defense strategy is parsed, the spatial coordinates of the real-time mapping of the digital twin are used to adjust the access control rules, and the strategy execution log is stored locally in an encrypted manner, and an evaluation audit log is generated.

[0012] As a preferred scheme of the information security evaluation method based on cloud computing,

[0013] The multi-modal data includes network traffic metadata, security audit logs and spatial coordinate information;

[0014] The collected multi-modal data is desensitized locally by trusted execution, including,

[0015] The eBPF program is mounted through the edge node kernel protocol stack, L3-L7 layer metadata is captured in real time, and the sampling frequency is dynamically adjusted based on bandwidth utilization;

[0016] The security audit log collects user operation events through the Linux Auditd framework, and uses a regular table to dynamically mask sensitive fields in a trusted execution environment; the masking rule is dynamically adjusted according to the data classification level;

[0017] When the spatial coordinate information is calculated by the three-dimensional coordinate trilateration algorithm, the Kalman filter is used to eliminate the multipath effect noise, and the non-collinear deployment of the Wi-Fi access point is combined to optimize the positioning accuracy.

[0018] As a preferred scheme of the information security evaluation method based on cloud computing,

[0019] The protocol type in the network traffic metadata is binary encoded to generate a byte identifier, the time interval frequency distribution of the same protocol data packet in the time window is counted, and the port number is compressed by range normalization;

[0020] The user ID in the security audit log is converted into a hash integer, the operation result is mapped into a Boolean value, and the event frequency is counted in a time window;

[0021] The GeoHash string in the spatial coordinate information is converted by base conversion, and the moving speed is calculated by the quotient of the coordinate difference of adjacent time windows and the time increment;

[0022] Based on the global mean and standard deviation pre-calculated by the cloud, the network traffic metadata, security audit logs and spatial coordinate information are respectively standardized by Z-score, and are spliced into a standardized feature vector.

[0023] As a preferred scheme of the information security evaluation method based on cloud computing, wherein the quantum heuristic algorithm comprises,

[0024] The path integral Monte Carlo method is used to simulate the quantum annealing process, the threat characteristics are mapped into quantum Hamiltonian, and the energy interaction relationship between characteristics is represented;

[0025] Through dynamic parameter adjustment, the annealing magnetic field strength is exponentially decayed with time to optimize the quantum state transition, the threat correlation strength activation threshold is dynamically calculated based on the global mean and standard deviation, low correlation noise is filtered, federated reinforcement learning is used to aggregate encrypted gradients, and a risk assessment model is constructed.

[0026] As a preferred scheme of the information security evaluation method based on cloud computing, wherein the space-time causal graph is constructed in combination with the threat intelligence library, and the root cause threat is located by applying the Do-Calculus algorithm,

[0027] Based on the quantum projection vector and the threat intelligence library, a space-time tensor is constructed by fusing the space-time label, and the spatial autocorrelation index is used to quantify the geographical aggregation of attack sources.

[0028] The average causal effect of the candidate node is calculated by the Do-Calculus algorithm combined with the time series Granger causality test, and the root cause threat is screened by using the CVSS vulnerability score and information entropy, and the root cause threat positioning result is output.

[0029] As a preferred scheme of the information security evaluation method based on cloud computing, wherein the evaluation audit log is generated,

[0030] The network traffic metadata, security audit logs and spatial coordinate information are fed back to the federated learning framework in real time, the risk assessment model weight is updated jointly, the optimized strategy execution log is stored in encrypted form, and the evaluation audit log is generated.

[0031] In a second aspect, the application provides an information security evaluation system based on cloud computing, comprising,

[0032] The data collection module is configured to collect multi-modal data, perform local desensitization processing on the multi-modal data through a trusted execution environment, attach a space-time label, and perform symmetric encryption and asymmetric negotiation for encryption using a node unique identifier to generate a space-time data packet;

[0033] The federated analysis module is configured to map the desensitized multi-modal data in the space-time data packet to a standardized feature vector by adopting secure multi-party computation to aggregate threat features through an edge node federated learning architecture, and construct a multi-modal threat matrix.

[0034] The quantum factorization module is configured to construct a risk assessment model based on a quantum heuristic algorithm, aggregate encrypted gradients of edge nodes through a federated reinforcement learning architecture, output a threat feature vector to a cloud causal reasoning engine, and construct a space-time causal graph in combination with a threat intelligence library to locate a root cause threat by applying a Do-Calculus algorithm and generate a dynamic defense strategy.

[0035] The dynamic defense and audit module is configured to parse the dynamic defense strategy based on an edge node, adjust access control rules using spatial coordinates mapped in real time by a digital twin, and locally encrypt and store a strategy execution log to generate an evaluation audit log.

[0036] In a third aspect, the present application provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and wherein the computer program, when executed by the processor, implements any step of the cloud computing-based information security evaluation method according to the first aspect of the present application.

[0037] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements any step of the cloud computing-based information security evaluation method according to the first aspect of the present application.

[0038] The present application has the following beneficial effects: by constructing a multi-modal threat evaluation system coupled with space-time, breakthroughs are achieved in the aspects of privacy protection and dynamic defense, the cross-modal correlation error of network traffic, security logs and spatial coordinates is reduced based on the cooperation of dynamic space-time labels and hybrid encryption mechanisms, and the semantic fragmentation in feature aggregation is effectively eliminated; by simulating the quantum annealing process through path integral Monte Carlo, and dynamically optimizing the Hamiltonian parameter in combination with federated reinforcement learning, the ground state energy convergence speed of the APT attack detection model is improved, and the false positive rate is reduced; further, by fusing the root cause positioning engine of the space-time causal graph and the CVSS vulnerability score, and combining real-time mapping with KL divergence constraints through digital twinning, the generation delay of the defense strategy is shortened, and resource consumption is reduced. The problems of insufficient correlation of multi-modal data, defense lag and verification fault in the cloud computing environment are solved, and the evaluation accuracy and response efficiency are cooperatively and transcendentally improved. BRIEF DESCRIPTION OF DRAWINGS

[0039] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the embodiments will be briefly introduced as follows. Obviously, the drawings in the following description only constitute some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without any creative effort on the basis of these drawings.

[0040] Fig. 1 The flow chart of data collection and encryption in the embodiment.

[0041] Fig. 2 The flow chart of quantum risk assessment in the embodiment.

[0042] Fig. 3 The flow chart of dynamic defense and audit in the embodiment.

[0043] Fig. 4 The module diagram of the information security assessment system based on cloud computing in the embodiment. DETAILED DESCRIPTION

[0044] In order to make the above objectives, features and advantages of the present application more apparent and comprehensible, the specific embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0045] In the following description, many specific details are set forth in order to provide a thorough understanding of the present application. However, the present application can be practiced in other ways different from those described herein without departing from the scope of the present application, and those skilled in the art can make similar extensions without departing from the scope of the present application, so the present application is not limited to the specific embodiments disclosed below.

[0046] Secondly, the "one embodiment" or "embodiment" referred to herein means that the specific features, structures or characteristics can be included in at least one implementation of the present application. "In one embodiment" appearing in different places in the specification does not mean the same embodiment, nor is it an independent or alternative embodiment that excludes other embodiments.

[0047] Embodiments, with reference to Figs. 1-4 For one embodiment of the present application, the embodiment provides an information security assessment method based on cloud computing, comprising the following steps:

[0048] S1, collect multi-modal data, perform local desensitization processing on the multi-modal data through a trusted execution environment, attach a space-time label, and perform symmetric encryption and asymmetric negotiation for encryption using a node unique identifier to generate a space-time data packet;

[0049] Specifically, the following steps are included:

[0050] S1.1, Network traffic metadata collection is through the deployment of network flow EBPF in cloud computing edge node, capturing L3-L7 layer metadata (source IP address, destination IP address, protocol type, port number, data packet load feature code), based on bandwidth monitoring, calculating bandwidth utilization once per second (1 second sliding window), calculating bandwidth utilization through exponential weighted moving average (EMA) smoothing algorithm.

[0051] Among them, based on the bandwidth monitoring dynamic adjustment of sampling frequency is default 100ms, traffic surge to 10ms.

[0052] Security audit log collection is through Linux Auditd framework to obtain operation security event log (user login, file access, process startup record), log field contains timestamp, user ID and operation result (success / failure).

[0053] Spatial coordinate information collection is through GPS to obtain outdoor longitude and latitude coordinates, using multi-frequency GNSS receiving signal, integrating RTK differential correction, in indoor environment, deploying 3 Wi-Fi access points supporting IEEE802.11mc protocol, in non-collinear triangle distribution, through Kalman filter to suppress multipath effect noise, calculating filtered distance value, based on three-dimensional coordinate solution algorithm.

[0054] S1.2, based on the trusted execution environment, through regular expression matching sensitive information (such as credit card number) in security audit log, dynamic masking of matching field, according to the preset rule (example: RFC1918 private address range) for part of the network traffic metadata in source IP address and destination IP address (example: 192.168.1.1→192.168).

[0055] Using AES-128-GCM algorithm to encrypt the desensitized security audit log and traffic metadata, the key is dynamically generated by the hardware random number generator in the trusted execution environment, and is bound to the CPU physical fingerprint through the SGX sealing storage technology.

[0056] It should be noted that the session key is used for single node communication session, which is destroyed after the session ends, and the long-term key is used for cross-session identity authentication, which is replaced every 24 hours.

[0057] S1.3, Unix timestamp is divided into time window according to fixed interval (example: 10 minute granularity), longitude and latitude coordinates are encoded into string by using GeoHash algorithm, encoding accuracy is dynamically adjusted according to the privacy level of the area where the device is located, time window identifier and geographical grid code are spliced into space-time labeled data.

[0058] S1.4, encrypt the desensitized data with space-time label by AES-256-GCM, combine with ECDH over Curve25519 to negotiate the key, and encapsulate it as a space-time data packet.

[0059] S2, through the edge node federated learning architecture, adopt secure multi-party computation to aggregate threat features, map the desensitized multi-modal data in the space-time data packet to a standardized feature vector, and construct a multi-modal threat matrix.

[0060] S2.1, each edge node as a client establishes a horizontal federated learning architecture with a cloud coordinator, and ensures that only authorized devices participate through X.509 certificate verification.

[0061] Using additive secret sharing protocol, each node splits the local model gradient into as many shards as the number of participating nodes (e.g. 3 nodes split into 3 parts), and through large prime modulus operation, ensures that the shard value is in a finite field, and after encryption, distributes it to other nodes.

[0062] It should be noted that the shard is encrypted by AES-128-GCM, the key is dynamically generated by the trusted execution environment (TEE), and is bound to the node hardware fingerprint, and needs 3-node threshold BLS signature verification to resist collusion attacks.

[0063] S2.2, decrypt the space-time data packet in the trusted execution environment, and map the multi-modal data according to the rules.

[0064] Among them, the rule-based mapping of multi-modal data is:

[0065] Network traffic metadata is encoded as a 1-byte binary identifier by protocol type, the time interval frequency distribution of data packets of the same protocol type within 10 minutes is counted, the port number is normalized to the [0, 1] interval value, and the load hash (BLAKE3 algorithm generates a 64-byte hash value) is truncated to the first 16 bytes;

[0066] The security audit log is hashed as a 32-bit integer for user ID, the operation result is encoded as a Boolean value (success = 1 / failure = 0), and the time interval is counted by 10-minute window frequency;

[0067] The spatial coordinate information is converted to a 5-bit integer from a GeoHash string, and the moving speed is calculated by the coordinate difference in the time window.

[0068] Based on the global mean and standard deviation pre-calculated by the cloud every hour, Z-score standardization is performed to eliminate dimensional differences, and a standardized 58-dimensional feature vector is generated.

[0069] It should be noted that the network traffic metadata is 18-dimensional, the security audit log is 34-dimensional, and the spatial coordinate information is 6-dimensional, which constitutes a standardized 58-dimensional feature vector.

[0070] S2.3, using Paillier homomorphic encryption, encrypt the standardized 58-dimensional feature vector and upload it to the cloud. The cloud performs a ciphertext multiplication operation, aggregates the encrypted features of all nodes, and then decrypts using the private key to construct a 58x58 multi-modal threat matrix.

[0071] wherein the threat matrix represents the cross-modal correlation strength between the two types of features, the association of network traffic metadata and security audit logs, the analysis of the correlation between TCP protocol traffic surge and login failure times, the association of spatial coordinates and network traffic, and the detection of geographic clustering of abnormal port access behavior.

[0072] S3, based on a quantum heuristic algorithm to build a risk assessment model, aggregate encrypted gradients of edge nodes through a federated reinforcement learning architecture, output threat feature vectors to a cloud causal reasoning engine, and construct a spatio-temporal causal graph combined with a threat intelligence library to locate root threats using the Do-Calculus algorithm and generate dynamic defense strategies;

[0073] S3.1, map the multi-modal threat matrix into a quantum Hamiltonian by inputting it into a quantum heuristic, which is used to represent the interaction energy between features. Path integral Monte Carlo is used to simulate the quantum annealing process, and Markov chain sampling is used to solve the ground state energy.

[0074] wherein the quantum Hamiltonian is represented as:

[0075]

[0076] wherein M jk is the cross-modal correlation strength of the jth dimension and the kth dimension of the feature, is the activation state of the jth dimension, is the activation state of the kth dimension, is the jth dimension of the driving quantum state transition, Γ(t) is the magnetic field strength annealed over time t, j is the single-dimensional feature index, k is the correlation dimension index, t is the time, x is the driving quantum state transition, and H is the multi-modal threat quantum Hamiltonian.

[0077] wherein the quantum annealing simulation is represented as:

[0078]

[0079] wherein Z is the normalization factor, β is the inverse temperature parameter, θ is the threat correlation strength activation threshold, ReLU is the filter for low correlation noise, V proj (j) is the excitation probability of the jth feature in quantum annealing, dt is the time differential, and T is the total annealing time.

[0080] S3.2 input the quantum projection vector into the federated reinforcement learning architecture, generate the weight adjustment amount through the policy network, use the cloud aggregation encrypted gradient to update the global weight.

[0081] wherein the quantum projection vector is input into the federated reinforcement learning, and the weight adjustment amount generated through the policy network is represented as:

[0082]

[0083] wherein V proj is a complete probability distribution vector, λ is a control risk assessment model escape ability of local optimal solution, tan h is a hyperbolic tangent function, ΔW i is a federated quantum dynamic weight adjustment amount, Ent(V proj ) is a feature distribution over-concentration suppression, and η is a control weight adjustment amount.

[0084] It should be noted that, is a feature gating function, Mjj is a threat matrix diagonal element, μ is a global mean, and σ is a global standard deviation.

[0085] wherein the cloud aggregation encrypted gradient is used to update the global weight, and is represented as:

[0086]

[0087] wherein R i is a random mask generated by a node, PRG is a pseudo-random generator, and R is an XOR operation gradient confusion, m is a training round, N is the total number of edge nodes of federated learning, is a weight vector of the federated learning global risk assessment model after training, is a weight vector of the federated learning global risk assessment model after the m+1th round of training.

[0088] S3.3, multiply the projection vector generated by quantum annealing and the weight vector of the federated learning optimal global risk assessment model after training by Hadamard product element by element, and dynamically constrain the threat feature vector amplitude to [-1, 1] based on L2 normalization combined with a minimum constant, to generate a threat feature vector.

[0089] wherein the L2 normalization is represented as:

[0090]

[0091] wherein V threat is a normalized threat feature vector, is an element-wise product, and ∈ is a minimum constant.

[0092] S3.4, the threat feature vector is fused with the time stamp and the geographical grid code in the threat intelligence library using multi-source heterogeneous data fusion, and a space-time tensor is constructed.

[0093] wherein the space-time tensor is constructed.

[0094]

[0095] wherein T uml is the space-time tensor, u is the spatial grid index, m is the time window index, l is the threat feature dimension index, s u is the center coordinate of the spatial grid u, t m is the start time of the mth time window, t0 is the first detection time of the attack, s src is the attack source coordinate, γ is the spatial decay radius, and α is the time decay coefficient.

[0096] The suppression of high-frequency noise using the space-time decay function is represented as:

[0097] w(τ)=e -ατ ·sin c(ζτ)(ζ=0.5);

[0098] wherein w(τ) is the time-domain window function that suppresses high-frequency noise and preserves the low-frequency characteristics of threat propagation, τ is the time interval quantifying the evolution of the threat over time, e -aτ is the exponential decay of the threat signal strength as the time interval τ increases, ζ is the frequency band width adjustment of the sin c function, affecting the strength of noise suppression, and sin c(ζτ) is the restriction of the signal frequency band width, suppressing high-frequency noise.

[0099] S3.5, based on the causal discovery algorithm and the time series Granger causality test, a space-time causal graph is constructed, and the candidate root node in the causal graph is applied to the Do-Calculus to calculate the intervention analysis.

[0100] wherein the causal discovery algorithm and the time series Granger causality test are represented as:

[0101]

[0102] wherein C mn is the causal effect strength, is the value of the threat feature l of the spatial grid u at time t, s u is the coordinate of the spatial grid u, s v is the associated grid coordinate, Δτ is the dynamic optimization time lag parameter, Moran's I(s u , s v ) is the spatial autocorrelation index, and ξ is the balance between local and global correlation.

[0103] wherein the post-intervention analysis is calculated using Do-Calculus as:

[0104]

[0105] wherein ACE(v p ) is the average causal effect, v p is the node identifier in the causal graph, Pa(v p ) is the set of all direct predecessors of v p , z is the parent node value combination, P(z) is the parent node combination probability, E[Eff|v p = 1, z] is the expected defense effect Eff when v p is blocked and the parent node combination is z, E[Eff|v p = 0, z] is the expected defense effect Eff when v p is not blocked and the parent node combination is z, p is the unique index of the node in the causal graph, Eff is the defense effect indicator, and v p is the specific threat node in the causal graph.

[0106] S3.6, based on the causal effect intensity and the average causal effect, the CVSS vulnerability score and the information entropy suppression are fused to calculate the threat score, and a dynamic defense strategy is generated.

[0107] wherein the fusion of the CVSS vulnerability score and the information entropy suppression to calculate the threat score is expressed as:

[0108]

[0109] wherein R p is the threat score of node p, CVSS(v p ) is the vulnerability CVSS score corresponding to node p, and Entropy(v p ) is the information entropy of node p, quantifying the uncertainty of its behavior.

[0110] Based on the threat score and the vulnerability severity, a defense action (block / isolate / entrap) is dynamically generated, and the effective period of the strategy is adaptively adjusted through the Sigmoid function combined with the attack geographic diffusion rate, to finally generate a standardized dynamic defense strategy.

[0111] S4, based on the edge node, the dynamic defense strategy is parsed and executed, the spatial coordinates mapped in real time by digital twin are used to adjust the access control rules, and the strategy execution log is stored locally and encrypted;

[0112] S4.1, the dynamic defense strategy is constructed into a syntax tree by extending the Backus-Naur form, and parsed into an atomized instruction set containing action type, target object, and effective condition (spatial-temporal constraint).

[0113] Using formal verification tool Z3 to solve constraints of atomized instruction set, ensuring that each policy only maps unique actions (such as blocking and trapping the same target mutual exclusive), generating standardized instructions after eliminating execution conflicts.

[0114] S4.2, based on the space-time label and threat score in the standardized instruction, the physical node coordinates are mapped to the digital twin space through the Kriging spatial interpolation algorithm.

[0115] Virtual coordinates are generated in combination with threat diffusion paths; when the attack source is located on the diffusion path and the time is within the threat window, the blocking priority is calculated through the logistic function, and dynamic access control rules are generated.

[0116] S4.3, according to the ACL priority, using reinforcement learning (PPO) to optimize the defense queue, the objective function balances the threat suppression weight and resource consumption, and the KL divergence is used to constrain the policy update amplitude, generating two types of policy execution instructions, (real-time blocking generates dynamic packet loss rules based on traffic hash, and precise trapping selects the honeypot configuration with the highest cosine similarity and the lowest cost. ) and record through local log.

[0117] S4.4, using structured compression to aggregate logs by time window, removing redundant fields (such as repeated space-time labels), generating compact binary format.

[0118] AES-256-GCM algorithm is used to encrypt the log, and the key is generated and stored by the edge node hardware security module.

[0119] Among them, the evaluation audit log is generated.

[0120] It should be noted that the security audit log and spatial coordinate information are fed back to the federated learning framework, and each edge node first encrypts the local risk assessment model through Paillier homomorphic encryption, and the cloud aggregates encrypted gradients and decrypts to update the global risk assessment model weight.

[0121] The execution process record contains the action type, target IP, timestamp, and spatial grid encoding log, which is aggregated in 10-minute windows, and the SHA3-256 hash chain is used to ensure continuity.

[0122] The hardware fingerprint binding key (AES-256-GCM) is used to encrypt the storage to the local trusted execution environment, and the zk-SNARK arithmetic circuit is used to verify the integrity of the hash chain, and the evaluation audit log is generated.

[0123] The embodiment also provides a cloud computing-based information security evaluation system, comprising a data acquisition module, a federal analysis module, a quantum factor module and a dynamic defense and intelligent audit module; the data acquisition module is used for acquiring multi-modal data, performing local desensitization processing on the multi-modal data through a trusted execution environment, adding a space-time label, and performing symmetric encryption and asymmetric negotiation encryption by using a node unique identifier to generate a space-time data packet; the federal analysis module is used for mapping the desensitized multi-modal data in the space-time data packet to a standardized feature vector by using a secure multi-party computation to aggregate threat features through an edge node federal learning architecture, and constructing a multi-modal threat matrix; the quantum factor module is used for constructing a risk evaluation model based on a quantum heuristic algorithm, outputting a threat feature vector to a cloud end cause and effect reasoning engine by aggregating encrypted gradients of edge nodes through a federal reinforcement learning architecture, and constructing a space-time cause and effect diagram in combination with a threat intelligence library to locate a root cause threat by applying a Do-Calculus algorithm and generate a dynamic defense strategy; the dynamic defense and intelligent audit module is used for analyzing the dynamic defense strategy based on an edge node, adjusting access control rules by using a spatial coordinate mapped in real time by a digital twin, and locally encrypting and storing a strategy execution log to generate an evaluation audit log.

[0124] The embodiment also provides a computer device suitable for the cloud computing-based information security evaluation method, comprising a memory and a processor; the memory is used for storing computer executable instructions, and the processor is used for executing the computer executable instructions to implement the cloud computing-based information security evaluation method proposed in the above embodiment.

[0125] The computer device can be a terminal, and the computer device comprises a processor, a memory, a communication interface, a display screen and an input device connected through a system bus. The processor of the computer device is used for providing computing and control capabilities. The memory of the computer device comprises a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The communication interface of the computer device is used for wired or wireless communication with external terminals. The wireless communication can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer overlaid on the display screen, or a key, trackball or touchpad arranged on the shell of the computer device. The input device can also be an external keyboard, touchpad or mouse, etc.

[0126] The embodiment also provides a storage medium having a computer program stored thereon, the program being executed by a processor to implement the method for evaluating information security based on cloud computing proposed in the above embodiment; and the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as a static random access memory (SRAM), an electrically erasable programmable read-only memory (EEPROM), an erasable programmable read-only memory (EPROM), a programmable read-only memory (PROM), a read-only memory (ROM), a magnetic memory, a flash memory, a magnetic disk, or an optical disk.

[0127] To sum up, the application realizes breakthroughs in privacy protection and dynamic defense by constructing a spatiotemporal coupling multi-modal threat evaluation system, reduces cross-modal correlation errors of network traffic, security logs and spatial coordinates based on the cooperation of dynamic spatiotemporal tags and hybrid encryption mechanisms, effectively eliminates semantic fragmentation in feature aggregation, optimizes Hamiltonian parameters by simulating quantum annealing processes through path integral Monte Carlo, combines with federated reinforcement learning to dynamically optimize Hamiltonian parameters, improves the ground state energy convergence speed of the APT attack detection model and reduces the false positive rate, further combines with a root cause positioning engine of a spatiotemporal causal graph and a CVSS vulnerability score, combines with digital twin real-time mapping and KL divergence constraints to shorten the defense strategy generation delay and reduce resource consumption. The application solves the problems of insufficient multi-modal data correlation, defense lag and verification fault in the cloud computing environment, and realizes the coordinated breakthrough of evaluation accuracy and response efficiency.

[0128] It should be noted that the above embodiments are only used to illustrate the technical solutions of the application but not limit the application. Although the application has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the application can be modified or replaced equivalently without departing from the spirit and scope of the technical solutions of the application, and all of them should be covered in the scope of the claims of the application.

Claims

1. A cloud computing-based information security assessment method, characterized in that: Comprising, Collecting multi-modal data, performing local desensitization processing on the multi-modal data through a trusted execution environment, attaching a space-time label, and performing symmetric encryption and non-symmetric negotiation encryption using a node unique identifier to generate a space-time data packet; The collecting multi-modal data, performing local desensitization processing through a trusted execution includes, Mounting an eBPF program through an edge node kernel protocol stack, capturing L3-L7 layer metadata in real time, and dynamically adjusting the sampling frequency based on bandwidth utilization; The security audit log collects user operation events through the Linux Auditd framework, uses regular table expressions to dynamically mask sensitive fields in the trusted execution environment, and adjusts the masking rules dynamically according to the data classification level; When calculating the three-dimensional coordinates through the trilateration algorithm, the Kalman filter is used to eliminate the multipath effect noise, and the non-collinear deployment of the Wi-Fi access point is combined to optimize the positioning accuracy; Through the edge node federated learning architecture, the threat features are aggregated using secure multi-party computation, the desensitized multi-modal data in the space-time data packet is mapped into a standardized feature vector, and a multi-modal threat matrix is constructed; The steps of mapping the desensitized multi-modal data in the space-time data packet into a standardized feature vector through the edge node federated learning architecture and using secure multi-party computation to aggregate threat features are as follows, The protocol type in the network traffic metadata is binary encoded to generate a byte identifier, the time interval frequency distribution of the same protocol data packet in the time window is counted, and the port number is compressed through range normalization; The user ID in the security audit log is converted to a hash integer, the operation result is mapped to a Boolean value, and the event frequency is counted in a time window; The GeoHash string in the spatial coordinate information is converted to a base, and the moving speed is calculated through the quotient of the coordinate difference and the time increment of the adjacent time window; Based on the global mean and standard deviation precomputed in the cloud, the network traffic metadata, security audit log, and spatial coordinate information are respectively standardized by Z-score, and spliced into a standardized feature vector; Based on the quantum heuristic algorithm, a risk assessment model is constructed, the encrypted gradients of the edge nodes are aggregated through the federated reinforcement learning architecture, the threat feature vector is output to the cloud causal reasoning engine, and a space-time causal graph is constructed by combining the threat intelligence library, the root cause threat is located by applying the Do-Calculus algorithm, and a dynamic defense strategy is generated; The steps of applying the Do-Calculus algorithm to locate the root cause threat are as follows, Based on the quantum projection vector and the threat intelligence library, a space-time tensor is constructed by fusing the space-time label, and the spatial autocorrelation index is used to quantify the geographical aggregation of attack sources; Through the Do-Calculus algorithm combined with the time series Granger causality test, the average causal effect of the candidate nodes is calculated, and the root cause threat is filtered by using the CVSS vulnerability score and information entropy, and the root cause threat positioning result is output; Based on the edge node, the dynamic defense strategy is parsed, the spatial coordinates are adjusted by using the digital twin real-time mapping, the access control rules are adjusted, and the strategy execution log is stored locally and encrypted, and an evaluation audit log is generated. The edge node analyzes the dynamic defense strategy, adjusts the access control rule using the spatial coordinates of the digital twin real-time mapping, and the specific steps are as follows, Adopting digital twin real-time mapping virtual coordinates, calculating the blocking priority through the logistic function, and generating space-time sensitive access control rules; Using reinforcement learning to optimize defense queue scheduling, balancing threat suppression weight and resource consumption, and adjusting access control rules through KL divergence constraint strategy. 2.The cloud computing based information security evaluation method of claim 1, wherein: The generation of the evaluation audit log includes, The network traffic metadata, security audit log and spatial coordinate information are fed back to the federated learning framework in real time, the risk assessment model weight is updated jointly, the optimized strategy execution log is stored encrypted, and the evaluation audit log is generated.

3. A cloud computing-based information security assessment system based on the cloud computing-based information security assessment method of any one of claims 1-2, characterized in that: It includes a data acquisition module, a federal analysis module, a quantum factor module, and a dynamic defense and intelligent audit module. The data acquisition module is used to acquire multi-modal data, perform local desensitization processing on the multi-modal data through a trusted execution environment, add space-time labels, and use node unique identification for symmetric encryption and asymmetric negotiation for encryption to generate space-time data packets. The federal analysis module is used to aggregate threat features through a federated learning architecture of edge nodes, map desensitized multi-modal data in space-time data packets to standardized feature vectors, and construct a multi-modal threat matrix. The quantum factor module is used to construct a risk assessment model based on a quantum heuristic algorithm, aggregate encrypted gradients of edge nodes through a federated reinforcement learning architecture, output threat feature vectors to a cloud causal reasoning engine, and construct a space-time causal graph in combination with a threat intelligence library to locate root threats using a Do-Calculus algorithm and generate dynamic defense strategies. The dynamic defense and intelligent audit module is used to analyze the dynamic defense strategy based on the edge node, adjust the access control rule using the spatial coordinates of the digital twin real-time mapping, and store the strategy execution log locally encrypted to generate the evaluation audit log.

4. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that: The processor executes the computer program to realize the steps of the cloud computing-based information security evaluation method of any one of claims 1-2.

5. A computer readable storage medium having stored thereon a computer program, characterized in that: The computer program is executed by the processor to realize the steps of the cloud computing-based information security evaluation method of any one of claims 1-2.

Images