Intrusion detection and protection method in cloud computing environment

Abstract

The invention discloses an intrusion detection and protection method and system in a cloud computing environment, and the method comprises the steps: locking a target visitor of a certain access behavior after judging that the access behavior of a cloud database has an abnormal feature, confirming a specific data object accessed by the target visitor, extracting a key byte mode associated with the specific data object, and storing the key byte mode in the cloud database; and meanwhile, searching and loading a historical access record of the target visitor. According to the method, the encryption complexity is dynamically adjusted, so that the step-by-step reinforced protection of the sensitive data is realized. Compared with a traditional static encryption mode, the scheme can improve the security of the data in real time according to the abnormal degree of the access behavior, and especially in the face of potential brute force cracking or high-frequency access, the attack cost is effectively improved, and the risk of data leakage is remarkably reduced.

Description

Technical Field

[0001] The present invention belongs to the technical field of cloud computing environment security protection, and relates to an intrusion detection and protection method in a cloud computing environment. Background Art

[0002] With the widespread adoption of cloud computing technology, cloud data security has become a crucial component in ensuring business stability and user data privacy. Existing cloud computing environments typically employ intrusion detection and prevention systems to prevent unauthorized access, brute force attacks, and the leakage of sensitive data. These systems typically monitor access behavior and identify abnormal access through rule matching, then implement protective measures such as static encryption, access interruption, or rate limiting. While these methods have improved data protection capabilities to a certain extent, traditional static protection approaches have demonstrated numerous limitations in the face of complex and ever-changing threat scenarios.

[0003] In existing technologies, static encryption often uses fixed encryption algorithms or key strengths, lacking the ability to dynamically adjust. This prevents the system from implementing real-time protection for sensitive data based on risk levels when faced with abnormal access. Furthermore, while access interruption, a common defense measure, can quickly prevent potential threats, it can cause business interruptions if it misidentifies normal access behavior, impacting user experience and service quality. Furthermore, traditional rate limiting methods typically utilize fixed values and lack the flexibility to adjust based on the severity of abnormal access behavior, resulting in inefficient prevention and control of high-risk access. Summary of the Invention

[0004] To solve the above problems, the present invention adopts a technical solution: a method for intrusion detection and protection in a cloud computing environment, comprising the following steps:

[0005] S1: After determining that a certain cloud database access behavior has abnormal characteristics, locate the target visitor of this access behavior, confirm the specific data object accessed by the visitor, extract the key byte pattern associated with the specific data object, and retrieve and load the historical access records of the target visitor;

[0006] S2: Analyze the target visitor's historical access records and determine whether the target visitor's access frequency to the current key byte pattern and its similar patterns is greater than a preset threshold. If the target visitor's access frequency to the current key byte pattern and its similar patterns exceeds the preset threshold, mark the key byte pattern and its similar patterns as specific byte patterns and proceed to S3. Otherwise, return to S1.

[0007] S3: Analyze and determine whether there are any sensitive encrypted files directly associated with the specific byte pattern in the cloud database. If there are any sensitive encrypted files directly associated with the specific byte pattern, extract the core behavioral features of the historical access records and current access behavior based on the target visitor's historical access records and current access behavior, and proceed to S4. Otherwise, return to S1.

[0008] S4: Based on the extracted core behavioral features, dynamic adjustment parameters are comprehensively generated. Based on the dynamic adjustment parameters, the encryption complexity of sensitive encrypted files is dynamically enhanced, and the decryption throughput rate of target visitors is dynamically restricted in reverse order to achieve intrusion detection and protection in cloud computing environments.

[0009] Furthermore: the key byte pattern and its similar patterns refer to a specific byte sequence related to a specific data object in the current access behavior and other byte patterns that are similar or associated with the specific byte sequence;

[0010] Similar patterns include byte sequences that partially match the structure of key byte patterns, patterns that are functionally or logically related but have been distorted through encoding or encryption, and potential related patterns inferred from the historical behavior of target visitors.

[0011] Furthermore, the core behavioral features extracted from the historical access records and the current access behavior include: access frequency deviation features, target concentration deviation features, and specific byte pattern abnormality scores.

[0012] Furthermore, the analysis of whether there is a sensitive encrypted file directly associated with a specific byte pattern in the cloud database, and if so, the process of extracting the core behavior features of the target visitor by combining the historical access records and current access behavior of the target visitor is as follows:

[0013] Perform matching analysis on specific byte patterns to determine whether there are sensitive encrypted files directly associated with the specific byte patterns in the cloud database;

[0014] If it is determined that there are sensitive encrypted files directly associated with specific byte patterns, key access behavior indicators are extracted based on the target visitor's historical access records and current access behavior, including the target visitor's current access frequency and historical average access frequency, the current target data access concentration and the average concentration of historical access targets, as well as the total bytes of the request data for this abnormal access and the number of bytes corresponding to the key byte pattern; the core behavioral characteristics of historical access records and current access behavior are extracted through quantitative methods.

[0015] Furthermore, the core behavioral features of historical access records and current access behaviors extracted by quantitative methods include:

[0016] Quantify the deviation between the current access frequency and the historical average access frequency, and derive the access frequency deviation characteristics.

[0017] Quantify the deviation between the current target data access concentration and the average concentration of historical access targets, and derive the target concentration deviation characteristics.

[0018] Divide the number of bytes corresponding to the key byte pattern by the total bytes of the request data for this abnormal access to obtain the abnormality score of the specific byte pattern.

[0019] Furthermore, the process of comprehensively generating dynamic adjustment parameters based on the extracted core behavioral features, and dynamically enhancing the encryption complexity of sensitive encrypted files and dynamically limiting the decryption throughput rate of target visitors based on the dynamic adjustment parameters is as follows:

[0020] The adjustment parameter calculation formula is called, and the extracted access frequency deviation characteristics, target concentration deviation characteristics, and specific byte pattern abnormality score are substituted into the formula for weighted calculation to generate the final dynamic adjustment parameter;

[0021] Obtain the current encryption complexity of the sensitive encrypted file and multiply the encryption complexity by a dynamic adjustment parameter to perform positive dynamic enhancement on it;

[0022] The current decryption throughput rate of the target visitor is obtained, and the decryption throughput rate is divided by the dynamic adjustment parameter to perform reverse dynamic restriction on it.

[0023] Furthermore: the adjustment parameter calculation formula is:

[0024]

[0025] Among them: D refers to the dynamic adjustment parameter, F current Refers to the current access frequency, F avg Refers to the historical average visit frequency, Refers to the access frequency deviation feature, w1 refers to the weight coefficient of the access frequency deviation feature, T current Refers to the current target data access concentration, T avg Refers to the average concentration of historical visit targets, refers to the target concentration deviation feature, w2 refers to the weight coefficient of the target concentration deviation feature, S specific refers to the abnormality score of a specific byte pattern, and w3 refers to the weight coefficient of the abnormality score of a specific byte pattern;

[0026] In the adjustment parameter calculation formula, Among them B key Refers to the number of bytes corresponding to the key byte pattern, B totalRefers to the total bytes of request data for this abnormal access.

[0027] An intrusion detection and protection system in a cloud computing environment, comprising:

[0028] Data acquisition module: After determining that a cloud database access behavior has abnormal characteristics, it is used to identify the target visitor of this access behavior, confirm the specific data object accessed by the visitor, extract the key byte pattern associated with the specific data object, and retrieve and load the historical access records of the target visitor;

[0029] Specific byte pattern determination module: used to determine the target visitor's historical access records and evaluate whether the target visitor's access frequency to the current key byte pattern and its similar patterns exceeds a preset threshold. If the target visitor's access frequency to the current key byte pattern and its similar patterns exceeds the threshold, the key byte pattern and its similar patterns are marked as specific byte patterns and transferred to the core behavior feature extraction module. Otherwise, the module returns to the data acquisition module.

[0030] Core Behavior Feature Extraction Module: This module analyzes and determines whether there are any sensitive encrypted files directly associated with a specific byte pattern in the cloud database. If so, the module extracts the core behavior features based on the target visitor's historical access records and current access behavior. The module then transfers the features to the adjustment parameter generation and application module. Otherwise, the module returns to the data acquisition module.

[0031] Adjustment parameter generation and application module: used to comprehensively generate dynamic adjustment parameters based on the extracted core behavioral features, and based on the dynamic adjustment parameters, to dynamically enhance the encryption complexity of sensitive encrypted files and dynamically limit the decryption throughput rate of target visitors, thereby realizing intrusion detection and protection in cloud computing environments.

[0032] Furthermore: the core behavior feature extraction module specifically includes:

[0033] The sensitive encrypted file check submodule is used to match and analyze specific byte patterns to determine whether there are sensitive encrypted files directly associated with the specific byte patterns in the cloud database;

[0034] The behavioral indicator extraction submodule is used to extract key access behavior indicators based on the target visitor's historical access records and current access behavior when there is a sensitive encrypted file directly associated with a specific byte pattern. These indicators include the target visitor's current access frequency and historical average access frequency, the current target data access concentration and the average concentration of historical access targets, as well as the total bytes of the request data for this abnormal access and the number of bytes corresponding to the key byte pattern.

[0035] The core behavior feature quantification submodule is used to quantify the degree of deviation between the current access frequency and the historical average access frequency to obtain the access frequency deviation characteristic, quantify the degree of deviation between the current target data access concentration and the average concentration of historical access targets to obtain the target concentration deviation characteristic, and divide the number of bytes corresponding to the key byte pattern by the total bytes of the request data for this abnormal access to obtain the abnormality score of the specific byte pattern.

[0036] Furthermore, the adjustment parameter generation and application module specifically includes:

[0037] The adjustment parameter calculation submodule is used to call the adjustment parameter calculation formula, substitute the extracted access frequency deviation characteristics, target concentration deviation characteristics and specific byte pattern abnormality score into the formula for weighted calculation, and generate the final dynamic adjustment parameter;

[0038] The encryption complexity adjustment submodule is used to obtain the current encryption complexity of the sensitive encrypted file and multiply the encryption complexity by the dynamic adjustment parameter to perform positive dynamic enhancement on it;

[0039] The decryption throughput rate adjustment submodule is used to obtain the current decryption throughput rate of the target visitor and divide the decryption throughput rate by the dynamic adjustment parameter to perform reverse dynamic restriction on it.

[0040] The present invention provides an intrusion detection and protection method and system in a cloud computing environment, which has the following advantages:

[0041] First, this invention achieves progressively stronger protection for sensitive data by dynamically adjusting encryption complexity. Compared to traditional static encryption methods, this solution can improve data security in real time based on the degree of abnormal access behavior. This effectively increases the cost of attacks against potential brute force attacks or high-frequency access, significantly reducing the risk of data leakage.

[0042] Secondly, the reverse dynamic limit on decryption throughput ensures that unauthorized access cannot quickly obtain sensitive information, buying valuable time for further analysis and response. Compared with traditional methods that directly interrupt access, this solution avoids the potential for service interruption caused by misjudgment and maximizes the balance between security and user experience.

[0043] Furthermore, this invention utilizes feature extraction and deviation calculation based on access behavior to effectively identify high-risk behaviors and dynamically adjust protection strategies. This flexibility and adaptability make it particularly suitable for complex multi-tenant scenarios in cloud computing environments. Through intelligent, progressive protection, this invention ensures data security while minimizing disruption to normal business operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0045] Figure 1 A flowchart of a method provided by an embodiment of the present invention;

[0046] Figure 2 A flowchart of obtaining core behavioral features corresponding to target visitors in the method provided in an embodiment of the present invention;

[0047] Figure 3 A flow chart of dynamically adjusting the encryption complexity of sensitive encrypted files and the decryption throughput rate of target visitors in a method provided by an embodiment of the present invention;

[0048] Figure 4 An application architecture diagram of the system provided by an embodiment of the present invention;

[0049] Figure 5 This is a structural block diagram of the core behavior feature extraction module in the system provided by an embodiment of the present invention;

[0050] Figure 6 This is a structural block diagram of the adjustment parameter generation and application module in the system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0051] It should be noted that, unless there is any conflict, the embodiments of the present invention and the features in the embodiments may be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0052] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. The following description of at least one exemplary embodiment is actually only illustrative and is in no way intended to limit the present invention and its application or use. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0053] Figure 1 A flow chart of a method provided by an embodiment of the present invention is shown.

[0054] A method for intrusion detection and protection in a cloud computing environment comprises the following steps:

[0055] S1: After determining that a certain cloud database access behavior has abnormal characteristics, locate the target visitor of this access behavior, confirm the specific data object accessed by the visitor, extract the key byte pattern associated with the specific data object, and retrieve and load the historical access records of the target visitor;

[0056] S2: Analyze the target visitor's historical access records, determine whether the target visitor's access frequency to the current key byte pattern and its similar patterns is greater than a preset threshold, and perform the first intrusion detection judgment; if the target visitor's access frequency to the current key byte pattern and its similar patterns exceeds the threshold, mark the key byte pattern and its similar patterns as specific byte patterns and proceed to S3; otherwise, return to S1;

[0057] S3: Analyze and determine whether there are sensitive encrypted files directly associated with the specific byte pattern in the cloud database, and perform a second intrusion detection judgment. If there are sensitive encrypted files directly associated with the specific byte pattern, combine the target visitor's historical access records and current access behavior to extract their core behavior features and proceed to S4. Otherwise, return to S1.

[0058] S4: Based on the extracted core behavioral features, dynamic adjustment parameters are comprehensively generated. Based on the dynamic adjustment parameters, the encryption complexity of sensitive encrypted files is dynamically enhanced, and the decryption throughput rate of target visitors is dynamically restricted in reverse order to achieve intrusion detection and protection in cloud computing environments.

[0059] Steps S1 / S2 / S3 / S4 are executed sequentially;

[0060] Specifically, the intrusion detection and protection method in a cloud computing environment includes the following steps:

[0061] Step S1: After determining that a certain access behavior of a cloud database has abnormal characteristics, the target visitor of this access behavior is locked, and the specific data object accessed by the visitor is confirmed. The key byte pattern associated with the specific data object is extracted, and the historical access record of the target visitor is retrieved and loaded.

[0062] In the embodiments of the present invention, the cloud database is a core component in a cloud computing environment. As part of cloud computing resources, it provides users with flexible data storage and management services. Featuring on-demand allocation, high availability, and a multi-tenant architecture, it supports dynamic application expansion, data analysis, and cross-regional data synchronization within the cloud computing environment. The cloud database typically works in conjunction with the computing, storage, and network resources of the cloud computing system to provide users with an integrated cloud service solution.

[0063] Determining whether access behavior has abnormal characteristics can be achieved through a variety of existing technologies, which have been widely used in current cloud computing and database management. Access frequency detection is a common method that determines whether access is abnormal by analyzing whether the number of requests per unit time significantly exceeds the historical average or a set threshold. For example, the access frequency can be counted using a sliding window counting method, and the upper and lower limits can be set based on the historical distribution. Behavioral pattern detection focuses on deviations from access patterns, such as whether the concentration of access to certain sensitive data objects has increased abnormally or whether access behavior contains specific illegal patterns, such as SQL injection strings. This type of detection can be based on rule matching (such as regular expressions) or machine learning methods, and can identify access behaviors that deviate from normal patterns by analyzing the characteristics of access sequences.

[0064] Identifying the specific data object accessed requires extracting target identifiers (such as database table names, field names, or file paths) from access requests. This information, combined with system log records and access metadata, can be used to precisely locate the access target. Extracting key byte patterns relies on byte-level analysis of the accessed data content to identify specific byte sequences or patterns associated with the target data object, such as file header identifiers, encrypted data fragments, or common encoding features.

[0065] Historical access records are a record of all interactions of a target visitor within a cloud database. These records are typically automatically generated by a logging system and are used to track visitor behavior patterns and assess potential anomaly risks. These records should include visitor identification information, such as user ID and IP address, as well as the timestamp of each visit, to analyze access frequency and behavioral distribution. The records should also include the target data identifier, such as the database table name, field name, or file path, to locate the specific data object accessed. The access operation type, such as query, insert, update, or delete, is also crucial for identifying access intent and the nature of the behavior. These records should also include specific data content related to the access request, such as query conditions, parameters, or a summary of uploaded data characteristics, to support the extraction and correlation analysis of key byte patterns. Furthermore, the total number of bytes of data and the number of bytes of key byte patterns involved in each access request should be reflected in the historical records to provide a basis for assessing the anomaly of specific byte patterns. By analyzing these records, we can extract key access behavior indicators, including a comparison of the target visitor's current access frequency with the historical average access frequency, the difference between the current target data access concentration and the average concentration of historical access targets, and the proportion of key byte patterns in the current abnormal access request data. This information, combined with the current abnormal access behavior, provides a precise basis for the subsequent generation of dynamic protection and adjustment strategies.

[0066] Key byte patterns refer to specific byte sequences within data content during access. These sequences possess a certain degree of identifiability or sensitivity, such as file signatures, encrypted tag data, or field value encoding patterns. Key byte pattern extraction can be combined with content scanning, feature matching algorithms, or predefined rules to provide a basis for subsequent anomaly analysis and correlation determination.

[0067] Furthermore, the intrusion detection and protection method in the cloud computing environment further includes the following steps:

[0068] Step S2: Analyze the target visitor's historical access records to determine whether the target visitor's access frequency to the current key byte pattern and its similar patterns exceeds a preset threshold. If the target visitor's access frequency to the current key byte pattern and its similar patterns exceeds the threshold, mark the key byte pattern and its similar patterns as specific byte patterns and proceed to S3. Otherwise, return to S1. The specific process is as follows;

[0069] The key byte pattern and similar patterns thereof refer to a specific byte sequence related to a specific data object in the current access behavior and other byte patterns that are similar or associated with the specific byte sequence.

[0070] Similar patterns include byte sequences that partially match the structure of key byte patterns, patterns that are functionally or logically related but have been distorted through encoding or encryption, and potential related patterns inferred from the historical behavior of target visitors.

[0071] In an embodiment of the present invention, the setting of the preset threshold is generally based on a statistical analysis of the historical access behavior of the target visitor and a summary of the regularities of typical access behavior during the normal operation of the system. Specifically, by analyzing the access frequency distribution in the historical access data, the average access frequency of a specific key word pattern and its similar patterns can be calculated, and a reasonable upper limit can be set as the threshold in combination with the standard deviation or quantile of the access frequency. In addition, the threshold can also be adjusted dynamically, for example, by making real-time corrections based on the overall system load, the visitor's permission level, or the sensitivity of the target data object, to ensure that the threshold can effectively identify abnormal behavior while minimizing false positives.

[0072] To assess whether the target visitor's access frequency for the current key byte pattern and its similar patterns exceeds a preset threshold, the following steps are performed: First, all access events involving the key byte pattern and its similar patterns in the target visitor's historical access records are extracted, the number of accesses within each time window is counted, and the proportional deviation between the current access frequency and the historical average access frequency is calculated. The deviation result is then compared with a preset threshold. If the current access frequency is significantly higher than the historical average and exceeds the preset threshold, it is determined to be abnormal access behavior.

[0073] The significance of marking key byte patterns and their similar patterns as specific byte patterns lies in clearly identifying potentially high-risk data features associated with the target visitor's current access. This marking is not only used for subsequent dynamic adjustment policies, such as limiting the target visitor's access rate or increasing the encryption complexity of related data objects, but also provides data support for long-term security monitoring. By recording specific byte patterns and their associated information, the system provides foundational data for further threat intelligence analysis and anomaly detection model optimization. The definition of key byte patterns and their similar patterns is derived from feature extraction and pattern matching of access data content. Specifically, key byte patterns are byte sequence features extracted from target data objects, typically including file headers, encryption identifiers, or encoding patterns. Similar patterns are related patterns generated through structural matching, semantic analysis, or historical behavior inference. For example, edit distance or hash value matching algorithms are used to identify byte sequences that are partially identical or distorted to key byte patterns. Machine learning models are used to analyze patterns in the visitor's historical behavior and infer potential related patterns. Ultimately, the extraction and identification of these patterns is achieved through a combination of rule matching, statistical analysis, and intelligent algorithms, laying the technical foundation for analyzing and addressing anomalous access behavior.

[0074] Furthermore, the intrusion detection and protection method in the cloud computing environment further includes the following steps:

[0075] Step S3: Analyze and determine whether there are any sensitive encrypted files directly associated with the specific byte pattern in the cloud database. If there are any sensitive encrypted files directly associated with the specific byte pattern, extract the target visitor's core behavior features, including access frequency deviation features, target concentration deviation features, and specific byte pattern abnormality scores, based on the target visitor's historical access records and current access behavior. Then proceed to S4; otherwise, return to S1.

[0076] Specifically, Figure 2 A flow chart for obtaining core behavioral features corresponding to target visitors is shown.

[0077] The following steps are involved: analyzing whether there are sensitive encrypted files directly associated with the specific byte pattern in the cloud database; if so, combining the target visitor's historical access records and current access behavior to extract their core behavioral features, including access frequency deviation features, target concentration deviation features, and specific byte pattern abnormality scores.

[0078] Step S301: performing matching analysis on a specific byte pattern to check whether there is a sensitive encrypted file directly associated with the specific byte pattern in the cloud database;

[0079] Step S302: If it is determined that the target visitor exists, key access behavior indicators are extracted based on the target visitor's historical access records and current access behavior, including the target visitor's current access frequency and historical average access frequency, the current target data access concentration and the average concentration of historical access targets, as well as the total bytes of the request data for this abnormal access and the number of bytes corresponding to the key byte pattern;

[0080] Step S303: Quantify the degree of deviation between the current access frequency and the historical average access frequency to obtain the access frequency deviation characteristic; quantify the degree of deviation between the current target data access concentration and the average concentration of historical access targets to obtain the target concentration deviation characteristic; divide the number of bytes corresponding to the key byte pattern by the total bytes of the request data for this abnormal access to obtain the abnormality score of the specific byte pattern;

[0081] In an embodiment of the present invention, the relevance of sensitive encrypted files is determined by matching specific byte patterns with the metadata and data content of encrypted files in a database. This method involves verifying the relevance using hash value comparisons, byte sequence feature matching, and encrypted file identification information (such as encryption algorithm type and file header features). The system extracts these features and compares them one by one to determine whether a specific byte pattern is directly associated with a sensitive encrypted file. If a correlation is confirmed, the system marks the sensitive encrypted file as an analysis target for subsequent behavioral feature extraction and risk assessment.

[0082] The current access frequency and historical average access frequency of the target visitor are extracted based on the timestamp and access event statistics in the log records. The current access frequency is obtained by calculating the number of requests per unit time; combined with historical access records, the average access frequency of visitors to the same specific byte pattern is calculated to quantify the access frequency deviation characteristics. The current target data access concentration and the average concentration of historical access targets are obtained by analyzing the distribution of visitors' access to different data objects within a specific time period. The current concentration can be obtained by calculating the proportion of visitors' access to a certain target data object, while the historical average concentration is calculated based on the distribution pattern of long-term access data. The total bytes of the request data for abnormal access and the number of bytes corresponding to the key byte pattern are obtained by directly counting the total data length of the current request and the number of bytes matching the specific byte pattern, respectively.

[0083] The selection of these features has clear analytical significance. The access frequency deviation feature can quantify the degree of deviation between a visitor's current access behavior and their historical behavior, and is used to detect abnormal access. The target concentration deviation feature determines potential threat behaviors by identifying whether access behavior is highly concentrated on a certain data object, such as excessive requests for sensitive data. The specific byte pattern anomaly score directly reflects the proportion of abnormal byte patterns in the current request, indicating the risk of potential leakage of sensitive information in the data. By combining these features, the system can more accurately assess the abnormal behavior of target visitors and provide data support for dynamic adjustment and risk prevention and control.

[0084] Furthermore, the intrusion detection and protection method in the cloud computing environment further includes the following steps:

[0085] Step S4, based on the extracted core behavior features, comprehensively generate dynamic adjustment parameters, and according to the dynamic adjustment parameters, perform positive dynamic enhancement on the encryption complexity of sensitive encrypted files, and reverse dynamic restriction on the decryption throughput rate of target visitors.

[0086] Specifically, Figure 3 A flow chart for dynamically adjusting the encryption complexity of sensitive encrypted files and the decryption throughput rate of target visitors is shown.

[0087] Based on the extracted core behavioral features, dynamic adjustment parameters are comprehensively generated. Based on the dynamic adjustment parameters, the encryption complexity of sensitive encrypted files is dynamically enhanced, and the decryption throughput rate of target visitors is dynamically restricted. The specific steps include the following:

[0088] Step S401: Calling the adjustment parameter calculation formula, substituting the extracted access frequency deviation feature, target concentration deviation feature, and specific byte pattern abnormality score into the formula for weighted calculation to generate the final dynamic adjustment parameter;

[0089] Step S402: obtaining the current encryption complexity of the sensitive encrypted file and multiplying the encryption complexity by a dynamic adjustment parameter to perform positive dynamic enhancement on the encryption complexity;

[0090] Step S403: Obtain the current decryption throughput rate of the target visitor, and divide the decryption throughput rate by the dynamic adjustment parameter to perform reverse dynamic restriction on it.

[0091] The adjustment parameter calculation formula is:

[0092]

[0093] Among them: D refers to the dynamic adjustment parameter, F current Refers to the current access frequency, F avg Refers to the historical average visit frequency, Refers to the access frequency deviation feature, w1 refers to the weight coefficient of the access frequency deviation feature, T current Refers to the current target data access concentration, T avg Refers to the average concentration of historical visit targets, refers to the target concentration deviation feature, w2 refers to the weight coefficient of the target concentration deviation feature, S specific refers to the abnormality score of a specific byte pattern, and w3 refers to the weight coefficient of the abnormality score of a specific byte pattern;

[0094] In the adjustment parameter calculation formula, Among them B key Refers to the number of bytes corresponding to the key byte pattern, B total Refers to the total bytes of request data for this abnormal access.

[0095] For the dynamic adjustment of encryption complexity and decryption throughput, the calculation method is not limited to simple multiplication or division operations, but can also be combined with more flexible and complex calculation methods. For example, nonlinear functions (such as exponential or logarithmic functions) can be used to enhance the sensitivity of the adjustment, so that the adjustment is relatively gentle when the deviation is small, and the adjustment amplitude increases rapidly when the deviation is large. In addition, different adjustment strategies can be set through piecewise functions, such as maintaining the existing encryption complexity or throughput at low deviations, adjusting proportionally in the medium and high deviation ranges, and taking fixed value limits or breakpoint protection after exceeding the limit value. For the adjustment of encryption complexity, a dynamic parameter superposition mechanism can also be introduced, such as adding additional encryption iterations or confusion layers on the basis of the existing complexity, so as to achieve more refined dynamic enhancement. Such a design not only improves the flexibility of adjustment, but also better adapts to the security needs and performance requirements of different scenarios.

[0096] In an embodiment of the present invention, the current encryption complexity of the sensitive encrypted file is obtained and multiplied by the dynamic adjustment parameter. The significance of the positive dynamic enhancement is that by improving the strength of the encryption algorithm (such as upgrading from AES-128 to AES-256) or extending the length of the encryption key, the sensitive data is made more difficult to be cracked under potential threats. This adjustment method ensures that when the access behavior is judged to be abnormal, the protection layer of the sensitive data is dynamically reinforced, effectively reducing the security risks caused by decryption attempts or data leaks. The current decryption throughput rate of the target visitor is obtained and divided by the dynamic adjustment parameter. The significance of the reverse dynamic restriction is that by reducing the speed of decrypting data, the transmission rate of sensitive information is slowed down, thereby buying more time for the system's threat assessment and response. This restriction method avoids the misjudgment and business impact that may be caused by directly interrupting access, and uses a gradual approach to dynamically restrict the behavior of potential threat actors. The advantage of this adjustment method is that it implements a flexible dynamic protection mechanism that can effectively protect sensitive data without completely interrupting access. Compared with traditional access interception or static encryption strategies, this dynamic adjustment mode is more intelligent and precise. It can adjust strategies in real time according to the abnormality of visitor behavior, ensuring data security while minimizing the impact on normal users.

[0097] This technology has broad application prospects, particularly in sectors such as finance, healthcare, and government where data security is paramount. For example, upon detecting an unusual transfer request, a banking system could dynamically increase the encryption level of transaction data while limiting the data access rate for the anomalous user, thereby reducing the risk of potential financial fraud. Furthermore, it can be applied to multi-tenant scenarios in cloud computing environments, dynamically protecting sensitive files and preventing malicious tenants from abusing resources.

[0098] In practice, suppose the system detects that a user's access frequency to an encrypted file has suddenly increased significantly, and the access concentration is biased towards sensitive fields in the file. After dynamically adjusting the parameter calculations, the system determines that the severity of the access anomaly is high. To this end, the system increases the encryption complexity of the file from a medium-level encryption algorithm to a high-intensity encryption algorithm. At the same time, the user's decryption rate is significantly reduced, allowing only a very small amount of data to be read per second. This adjustment not only effectively protects the security of sensitive data, but also provides sufficient time for further analysis and response to the user's access behavior. In this way, the system achieves a good balance between protection flexibility and data security.

[0099] The technical solution of the present invention is described in detail below through a specific example:

[0100] A cloud database system detected abnormal access behavior from a user to a specific encrypted file. Analysis revealed that the user's current access frequency was 120 times per minute, compared to a historical average of 50 times per minute. Further investigation of the user's access concentration revealed that 80% of requests were for a specific encrypted file, while the historical average concentration was only 50%. Furthermore, the number of bytes corresponding to the key byte pattern in the current access request was 400, while the total data size of the entire request was 2000 bytes.

[0101] By quantifying the deviations in access frequency, access concentration, and the proportion of key byte patterns, the system comprehensively derives a dynamic adjustment parameter with a value of 3.2, indicating that the current behavior is highly abnormal. In order to deal with this abnormal access, the system first obtains the encryption complexity of the current encrypted file. Assuming that the initial value of the encryption complexity is 128 (corresponding to the number of key bits of AES-128), the system multiplies this value by the dynamic adjustment parameter 3.2, and dynamically adjusts the encryption complexity to 409.6, which means that the key length is significantly increased. According to the system design, this complexity enhancement can be achieved by increasing the number of encryption operation iterations or upgrading the algorithm parameters of the key strength, thereby making file protection more stringent.

[0102] The system then detected that the user's current decryption throughput rate was 100MB per second. Combining dynamic adjustment parameters, the system decided to reduce this rate to 31.25MB / s, significantly slowing data transmission. This adjustment effectively prevented potential high-frequency data leaks while buying sufficient time for the system's subsequent monitoring and analysis. Through these dynamic adjustments, the encryption strength of sensitive files was dynamically enhanced, and the access behavior of abnormal users was effectively restricted. At the same time, the system did not completely interrupt the user's access, thereby avoiding excessive interference with possible normal business operations. This progressive dynamic response strategy balances security and business continuity, demonstrating the advantages of intelligent protection.

[0103] Further, Figure 4 The application architecture diagram of the system provided by the embodiment of the present invention is shown.

[0104] In another preferred embodiment of the present invention, the intrusion detection and protection system in a cloud computing environment includes:

[0105] The data acquisition module 100 is used to lock the target visitor of the access behavior after determining that a certain access behavior of the cloud database has abnormal characteristics, confirm the specific data object accessed by the visitor, extract the key byte pattern associated with the specific data object, and retrieve and load the historical access records of the target visitor.

[0106] In the embodiments of the present invention, the cloud database is a core component in a cloud computing environment. As part of cloud computing resources, it provides users with flexible data storage and management services. Featuring on-demand allocation, high availability, and a multi-tenant architecture, it supports dynamic application expansion, data analysis, and cross-regional data synchronization within the cloud computing environment. The cloud database typically works in conjunction with the computing, storage, and network resources of the cloud computing system to provide users with an integrated cloud service solution.

[0107] Determining whether access behavior has abnormal characteristics can be achieved through a variety of existing technologies, which have been widely used in current cloud computing and database management. Access frequency detection is a common method that determines whether access is abnormal by analyzing whether the number of requests per unit time significantly exceeds the historical average or a set threshold. For example, the access frequency can be counted using a sliding window counting method, and the upper and lower limits can be set based on the historical distribution. Behavioral pattern detection focuses on deviations from access patterns, such as whether the concentration of access to certain sensitive data objects has increased abnormally or whether access behavior contains specific illegal patterns, such as SQL injection strings. This type of detection can be based on rule matching (such as regular expressions) or machine learning methods, and can identify access behaviors that deviate from normal patterns by analyzing the characteristics of access sequences.

[0108] Identifying the specific data object accessed requires extracting target identifiers (such as database table names, field names, or file paths) from access requests. This information, combined with system log records and access metadata, can be used to precisely locate the access target. Extracting key byte patterns relies on byte-level analysis of the accessed data content to identify specific byte sequences or patterns associated with the target data object, such as file header identifiers, encrypted data fragments, or common encoding features.

[0109] Historical access records are a record of all interactions of a target visitor within a cloud database. These records are typically automatically generated by a logging system and are used to track visitor behavior patterns and assess potential anomaly risks. These records should include visitor identification information, such as user ID and IP address, as well as the timestamp of each visit, to analyze access frequency and behavioral distribution. The records should also include the target data identifier, such as the database table name, field name, or file path, to locate the specific data object accessed. The access operation type, such as query, insert, update, or delete, is also crucial for identifying access intent and the nature of the behavior. These records should also include specific data content related to the access request, such as query conditions, parameters, or a summary of uploaded data characteristics, to support the extraction and correlation analysis of key byte patterns. Furthermore, the total number of bytes of data and the number of bytes of key byte patterns involved in each access request should be reflected in the historical records to provide a basis for assessing the anomaly of specific byte patterns. By analyzing these records, we can extract key access behavior indicators, including a comparison of the target visitor's current access frequency with the historical average access frequency, the difference between the current target data access concentration and the average concentration of historical access targets, and the proportion of key byte patterns in the current abnormal access request data. This information, combined with the current abnormal access behavior, provides a precise basis for the subsequent generation of dynamic protection and adjustment strategies.

[0110] Key byte patterns refer to specific byte sequences within data content during access. These sequences possess a certain degree of identifiability or sensitivity, such as file signatures, encrypted tag data, or field value encoding patterns. Key byte pattern extraction can be combined with content scanning, feature matching algorithms, or predefined rules to provide a basis for subsequent anomaly analysis and correlation determination.

[0111] Furthermore, the intrusion detection and protection system in the cloud computing environment also includes:

[0112] The specific byte pattern determination module 200 is used to determine the historical access records of the target visitor and evaluate whether the target visitor's access frequency to the current key byte pattern and its similar patterns exceeds a preset threshold. If the target visitor's access frequency to the current key byte pattern and its similar patterns exceeds the threshold, the key byte pattern and its similar patterns are marked as specific byte patterns and transferred to the core behavior feature extraction module. Otherwise, it returns to the data acquisition module.

[0113] The key byte pattern and its similar patterns refer to a specific byte sequence related to a specific data object in the current access behavior and other byte patterns that are similar or associated with it;

[0114] Similar patterns include byte sequences that partially match the structure of key byte patterns, patterns that are functionally or logically related but have been distorted through encoding or encryption, and potential related patterns inferred from the historical behavior of target visitors.

[0115] In an embodiment of the present invention, the setting of the preset threshold is generally based on a statistical analysis of the historical access behavior of the target visitor and a summary of the regularities of typical access behavior during the normal operation of the system. Specifically, by analyzing the access frequency distribution in the historical access data, the average access frequency of a specific key word pattern and its similar patterns can be calculated, and a reasonable upper limit can be set as the threshold in combination with the standard deviation or quantile of the access frequency. In addition, the threshold can also be adjusted dynamically, for example, by making real-time corrections based on the overall system load, the visitor's permission level, or the sensitivity of the target data object, to ensure that the threshold can effectively identify abnormal behavior while minimizing false positives.

[0116] To assess whether the target visitor's access frequency for the current key byte pattern and its similar patterns exceeds a preset threshold, the following steps are performed: First, all access events involving the key byte pattern and its similar patterns in the target visitor's historical access records are extracted, the number of accesses within each time window is counted, and the proportional deviation between the current access frequency and the historical average access frequency is calculated. The deviation result is then compared with a preset threshold. If the current access frequency is significantly higher than the historical average and exceeds the preset threshold, it is determined to be abnormal access behavior.

[0117] The significance of marking key byte patterns and their similar patterns as specific byte patterns lies in clearly identifying potentially high-risk data features associated with the target visitor's current access. This marking is not only used for subsequent dynamic adjustment policies, such as limiting the target visitor's access rate or increasing the encryption complexity of related data objects, but also provides data support for long-term security monitoring. By recording specific byte patterns and their associated information, the system provides foundational data for further threat intelligence analysis and anomaly detection model optimization. The definition of key byte patterns and their similar patterns is derived from feature extraction and pattern matching of access data content. Specifically, key byte patterns are byte sequence features extracted from target data objects, typically including file headers, encryption identifiers, or encoding patterns. Similar patterns are related patterns generated through structural matching, semantic analysis, or historical behavior inference. For example, edit distance or hash value matching algorithms are used to identify byte sequences that are partially identical or distorted to key byte patterns. Machine learning models are used to analyze patterns in the visitor's historical behavior and infer potential related patterns. Ultimately, the extraction and identification of these patterns is achieved through a combination of rule matching, statistical analysis, and intelligent algorithms, laying the technical foundation for analyzing and addressing anomalous access behavior.

[0118] Furthermore, the intrusion detection and protection system in the cloud computing environment also includes:

[0119] The core behavior feature extraction module 300 is used to analyze and determine whether there are sensitive encrypted files directly associated with specific byte patterns in the cloud database. If there are sensitive encrypted files directly associated with specific byte patterns, the core behavior features are extracted based on the target visitor's historical access records and current access behavior, and the module is transferred to the adjustment parameter generation and application module. Otherwise, the module returns to the data acquisition module.

[0120] Specifically, Figure 5 FIG. 3 is a structural block diagram of a core behavior feature extraction module 300 in a system provided by an embodiment of the present invention.

[0121] In the preferred embodiment of the present invention, the core behavior feature extraction module 300 specifically includes:

[0122] The sensitive encrypted file checking submodule 301 is used to perform matching analysis on a specific byte pattern and check whether there is a sensitive encrypted file directly associated with the specific byte pattern in the cloud database;

[0123] The behavior indicator extraction submodule 302 is used to extract key access behavior indicators based on the target visitor's historical access records and current access behavior, if it is determined that the target visitor exists, including the target visitor's current access frequency and historical average access frequency, the current target data access concentration and the average concentration of historical access targets, as well as the total bytes of the request data of this abnormal access and the number of bytes corresponding to the key byte pattern;

[0124] The core behavior feature quantification unit 303 is used to quantify the degree of deviation between the current access frequency and the historical average access frequency to obtain the access frequency deviation feature, quantify the degree of deviation between the current target data access concentration and the average concentration of historical access targets to obtain the target concentration deviation feature, and divide the number of bytes corresponding to the key byte pattern by the total bytes of the request data of this abnormal access to obtain the abnormality score of the specific byte pattern.

[0125] In an embodiment of the present invention, the relevance of sensitive encrypted files is determined by matching specific byte patterns with the metadata and data content of encrypted files in a database. This method involves verifying the relevance using hash value comparisons, byte sequence feature matching, and encrypted file identification information (such as encryption algorithm type and file header features). The system extracts these features and compares them one by one to determine whether a specific byte pattern is directly associated with a sensitive encrypted file. If a correlation is confirmed, the system marks the sensitive encrypted file as an analysis target for subsequent behavioral feature extraction and risk assessment.

[0126] The current access frequency and historical average access frequency of the target visitor are extracted based on the timestamp and access event statistics in the log records. The current access frequency is obtained by calculating the number of requests per unit time; combined with historical access records, the average access frequency of visitors to the same specific byte pattern is calculated to quantify the access frequency deviation characteristics. The current target data access concentration and the average concentration of historical access targets are obtained by analyzing the distribution of visitors' access to different data objects within a specific time period. The current concentration can be obtained by calculating the proportion of visitors' access to a certain target data object, while the historical average concentration is calculated based on the distribution pattern of long-term access data. The total bytes of the request data for abnormal access and the number of bytes corresponding to the key byte pattern are obtained by directly counting the total data length of the current request and the number of bytes matching the specific byte pattern, respectively.

[0127] The selection of these features has clear analytical significance. The access frequency deviation feature can quantify the degree of deviation between a visitor's current access behavior and their historical behavior, and is used to detect abnormal access. The target concentration deviation feature determines potential threat behaviors by identifying whether access behavior is highly concentrated on a certain data object, such as excessive requests for sensitive data. The specific byte pattern anomaly score directly reflects the proportion of abnormal byte patterns in the current request, indicating the risk of potential leakage of sensitive information in the data. By combining these features, the system can more accurately assess the abnormal behavior of target visitors and provide data support for dynamic adjustment and risk prevention and control.

[0128] Furthermore, the intrusion detection and protection system in the cloud computing environment also includes:

[0129] The adjustment parameter generation and application module 400 is used to comprehensively generate dynamic adjustment parameters based on the extracted core behavioral features, and based on the dynamic adjustment parameters, dynamically enhance the encryption complexity of sensitive encrypted files and dynamically limit the decryption throughput rate of target visitors.

[0130] Specifically, Figure 6 It shows a structural block diagram of the adjustment parameter generation and application module 400 in the system provided by an embodiment of the present invention.

[0131] In a preferred embodiment of the present invention, the adjustment parameter generation and application module 400 specifically includes:

[0132] The adjustment parameter calculation unit 401 is used to call the adjustment parameter calculation formula, substitute the extracted access frequency deviation feature, target concentration deviation feature and specific byte pattern abnormality score into the formula for weighted calculation, and generate the final dynamic adjustment parameter;

[0133] The encryption complexity adjustment unit 402 is used to obtain the current encryption complexity of the sensitive encrypted file and multiply the encryption complexity by a dynamic adjustment parameter to perform positive dynamic enhancement on the encryption complexity;

[0134] The decryption throughput rate adjustment unit 403 is used to obtain the current decryption throughput rate of the target visitor and divide the decryption throughput rate by the dynamic adjustment parameter to perform reverse dynamic restriction on the decryption throughput rate.

[0135] The adjustment parameter calculation formula is:

[0136]

[0137] Among them: D refers to the dynamic adjustment parameter, F current Refers to the current access frequency, F avg Refers to the historical average visit frequency, Refers to the access frequency deviation feature, w1 refers to the weight coefficient of the access frequency deviation feature, T current Refers to the current target data access concentration, T avg Refers to the average concentration of historical visit targets, refers to the target concentration deviation feature, w2 refers to the weight coefficient of the target concentration deviation feature, S specific refers to the abnormality score of a specific byte pattern, and w3 refers to the weight coefficient of the abnormality score of a specific byte pattern;

[0138] In the adjustment parameter calculation formula, Among them B key Refers to the number of bytes corresponding to the key byte pattern, B total Refers to the total bytes of request data for this abnormal access.

[0139] For the dynamic adjustment of encryption complexity and decryption throughput, the calculation method is not limited to simple multiplication or division operations, but can also be combined with more flexible and complex calculation methods. For example, nonlinear functions (such as exponential or logarithmic functions) can be used to enhance the sensitivity of the adjustment, so that the adjustment is relatively gentle when the deviation is small, and the adjustment amplitude increases rapidly when the deviation is large. In addition, different adjustment strategies can be set through piecewise functions, such as maintaining the existing encryption complexity or throughput at low deviations, adjusting proportionally in the medium and high deviation ranges, and taking fixed value limits or breakpoint protection after exceeding the limit value. For the adjustment of encryption complexity, a dynamic parameter superposition mechanism can also be introduced, such as adding additional encryption iterations or confusion layers on the basis of the existing complexity, so as to achieve more refined dynamic enhancement. Such a design not only improves the flexibility of adjustment, but also better adapts to the security needs and performance requirements of different scenarios.

[0140] In an embodiment of the present invention, the current encryption complexity of the sensitive encrypted file is obtained and multiplied by the dynamic adjustment parameter. The significance of the positive dynamic enhancement is that by improving the strength of the encryption algorithm (such as upgrading from AES-128 to AES-256) or extending the length of the encryption key, the sensitive data is made more difficult to be cracked under potential threats. This adjustment method ensures that when the access behavior is judged to be abnormal, the protection layer of the sensitive data is dynamically reinforced, effectively reducing the security risks caused by decryption attempts or data leaks. The current decryption throughput rate of the target visitor is obtained and divided by the dynamic adjustment parameter. The significance of the reverse dynamic restriction is that by reducing the speed of decrypting data, the transmission rate of sensitive information is slowed down, thereby buying more time for the system's threat assessment and response. This restriction method avoids the misjudgment and business impact that may be caused by directly interrupting access, and uses a gradual approach to dynamically restrict the behavior of potential threat actors. The advantage of this adjustment method is that it implements a flexible dynamic protection mechanism that can effectively protect sensitive data without completely interrupting access. Compared with traditional access interception or static encryption strategies, this dynamic adjustment mode is more intelligent and precise. It can adjust strategies in real time according to the abnormality of visitor behavior, ensuring data security while minimizing the impact on normal users.

[0141] This technology has broad application prospects, particularly in sectors such as finance, healthcare, and government where data security is paramount. For example, upon detecting an unusual transfer request, a banking system could dynamically increase the encryption level of transaction data while limiting the data access rate for the anomalous user, thereby reducing the risk of potential financial fraud. Furthermore, it can be applied to multi-tenant scenarios in cloud computing environments, dynamically protecting sensitive files and preventing malicious tenants from abusing resources.

[0142] In practice, suppose the system detects that a user's access frequency to an encrypted file has suddenly increased significantly, and the access concentration is biased towards sensitive fields in the file. After dynamically adjusting the parameter calculations, the system determines that the severity of the access anomaly is high. To this end, the system increases the encryption complexity of the file from a medium-level encryption algorithm to a high-intensity encryption algorithm. At the same time, the user's decryption rate is significantly reduced, allowing only a very small amount of data to be read per second. This adjustment not only effectively protects the security of sensitive data, but also provides sufficient time for further analysis and response to the user's access behavior. In this way, the system achieves a good balance between protection flexibility and data security.

[0143] It should be understood that, although the various steps in the flow chart of each embodiment of the present invention are shown in sequence according to the indication of the arrows, these steps are not necessarily performed in sequence according to the order indicated by the arrows. Unless otherwise specified herein, the execution of these steps is not strictly limited in order, and these steps can be performed in other orders. Moreover, at least a portion of the steps in each embodiment may include a plurality of sub-steps or a plurality of stages, and these sub-steps or stages are not necessarily performed at the same time, but can be performed at different times, and the execution order of these sub-steps or stages is not necessarily performed in sequence, but can be performed in turn or alternately with at least a portion of other steps or sub-steps or stages of other steps.

[0144] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The program can be stored in a non-volatile computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0145] The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above-mentioned embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0146] The above-described embodiments merely illustrate several implementations of the present invention, and while their descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art would be able to make numerous variations and improvements without departing from the spirit of the present invention, all of which fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be determined by the appended claims.

[0147] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

[0148] The examples are only used to illustrate the technical solutions of the present invention, rather than to limit them. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some or all of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for intrusion detection and protection in a cloud computing environment, characterized by: The following steps are involved: S1: After determining that a certain cloud database access behavior has abnormal characteristics, locate the target visitor of this access behavior, confirm the specific data object accessed by the visitor, extract the key byte pattern associated with the specific data object, and retrieve and load the historical access records of the target visitor; S2: Analyze the target visitor's historical access records and determine whether the target visitor's access frequency to the current key byte pattern and its similar patterns is greater than a preset threshold. If the target visitor's access frequency to the current key byte pattern and its similar patterns exceeds the preset threshold, mark the key byte pattern and its similar patterns as specific byte patterns and proceed to S3. Otherwise, return to S1. S3: Analyze and determine whether there are any sensitive encrypted files directly associated with the specific byte pattern in the cloud database. If there are any sensitive encrypted files directly associated with the specific byte pattern, extract the core behavioral features of the historical access records and current access behavior based on the target visitor's historical access records and current access behavior, and proceed to S4. Otherwise, return to S1. S4: Based on the extracted core behavioral features, dynamic adjustment parameters are comprehensively generated. Based on the dynamic adjustment parameters, the encryption complexity of sensitive encrypted files is dynamically enhanced, and the decryption throughput rate of target visitors is dynamically restricted in reverse order to achieve intrusion detection and protection in cloud computing environments.

2. The intrusion detection and protection method in a cloud computing environment according to claim 1, characterized in that: The key byte pattern and its similar patterns refer to a specific byte sequence related to a specific data object in the current access behavior and other byte patterns that are similar or related to the specific byte sequence; Similar patterns include byte sequences that partially match the structure of key byte patterns, patterns that are functionally or logically related but have been distorted through encoding or encryption, and potential related patterns inferred from the historical behavior of target visitors.

3. The intrusion detection and protection method in a cloud computing environment according to claim 1, characterized in that: The core behavioral features of the extracted historical access records and current access behaviors include: access frequency deviation features, target concentration deviation features, and specific byte pattern abnormality scores.

4. The intrusion detection and protection method in a cloud computing environment according to claim 1, characterized in that: The process of analyzing whether there are sensitive encrypted files directly associated with the specific byte pattern in the cloud database and, if so, extracting the core behavior features of the target visitor by combining the historical access records and current access behavior of the target visitor is as follows: Perform matching analysis on specific byte patterns to determine whether there are sensitive encrypted files directly associated with the specific byte patterns in the cloud database; If it is determined that there are sensitive encrypted files directly associated with specific byte patterns, key access behavior indicators are extracted based on the target visitor's historical access records and current access behavior, including the target visitor's current access frequency and historical average access frequency, the current target data access concentration and the average concentration of historical access targets, as well as the total bytes of the request data for this abnormal access and the number of bytes corresponding to the key byte pattern; the core behavioral characteristics of historical access records and current access behavior are extracted through quantitative methods.

5. The intrusion detection and protection method in a cloud computing environment according to claim 4, characterized in that: The core behavioral features of historical access records and current access behaviors extracted by quantitative methods include: Quantify the deviation between the current access frequency and the historical average access frequency, and derive the access frequency deviation characteristics. Quantify the deviation between the current target data access concentration and the average concentration of historical access targets, and derive the target concentration deviation characteristics. Divide the number of bytes corresponding to the key byte pattern by the total bytes of the request data for this abnormal access to obtain the abnormality score of the specific byte pattern.

6. The intrusion detection and protection method in a cloud computing environment according to claim 1, characterized in that: The process of comprehensively generating dynamic adjustment parameters based on the extracted core behavioral features, and dynamically enhancing the encryption complexity of sensitive encrypted files and dynamically limiting the decryption throughput rate of target visitors based on the dynamic adjustment parameters is as follows: The adjustment parameter calculation formula is called, and the extracted access frequency deviation characteristics, target concentration deviation characteristics, and specific byte pattern abnormality score are substituted into the formula for weighted calculation to generate the final dynamic adjustment parameter; Obtain the current encryption complexity of the sensitive encrypted file and multiply the encryption complexity by a dynamic adjustment parameter to perform positive dynamic enhancement on it; The current decryption throughput rate of the target visitor is obtained, and the decryption throughput rate is divided by the dynamic adjustment parameter to perform reverse dynamic restriction on it.

7. The intrusion detection and protection method in a cloud computing environment according to claim 6, characterized in that: The adjustment parameter calculation formula is: Among them: D refers to the dynamic adjustment parameter, F current Refers to the current access frequency, F avg Refers to the historical average visit frequency, Refers to the access frequency deviation feature, w1 refers to the weight coefficient of the access frequency deviation feature, T current Refers to the current target data access concentration, T avg Refers to the average concentration of historical visit targets, refers to the target concentration deviation feature, w2 refers to the weight coefficient of the target concentration deviation feature, S specific refers to the abnormality score of a specific byte pattern, and w3 refers to the weight coefficient of the abnormality score of a specific byte pattern; In the adjustment parameter calculation formula, Among them B key Refers to the number of bytes corresponding to the key byte pattern, B total Refers to the total bytes of request data for this abnormal access.

8. An intrusion detection and protection system in a cloud computing environment, characterized by: include: Data acquisition module: After determining that a cloud database access behavior has abnormal characteristics, it is used to identify the target visitor of this access behavior, confirm the specific data object accessed by the visitor, extract the key byte pattern associated with the specific data object, and retrieve and load the historical access records of the target visitor; Specific byte pattern determination module: used to determine the target visitor's historical access records and evaluate whether the target visitor's access frequency to the current key byte pattern and its similar patterns exceeds a preset threshold. If the target visitor's access frequency to the current key byte pattern and its similar patterns exceeds the threshold, the key byte pattern and its similar patterns are marked as specific byte patterns and transferred to the core behavior feature extraction module. Otherwise, the module returns to the data acquisition module. Core Behavior Feature Extraction Module: This module analyzes and determines whether there are any sensitive encrypted files directly associated with a specific byte pattern in the cloud database. If so, the module extracts the core behavior features based on the target visitor's historical access records and current access behavior. The module then transfers the features to the adjustment parameter generation and application module. Otherwise, the module returns to the data acquisition module. Adjustment parameter generation and application module: used to comprehensively generate dynamic adjustment parameters based on the extracted core behavioral features, and based on the dynamic adjustment parameters, to dynamically enhance the encryption complexity of sensitive encrypted files and dynamically limit the decryption throughput rate of target visitors, thereby realizing intrusion detection and protection in cloud computing environments.

9. The intrusion detection and protection system in a cloud computing environment according to claim 8, characterized in that: The core behavior feature extraction module specifically includes: The sensitive encrypted file check submodule is used to match and analyze specific byte patterns to determine whether there are sensitive encrypted files directly associated with the specific byte patterns in the cloud database; The behavioral indicator extraction submodule is used to extract key access behavior indicators based on the target visitor's historical access records and current access behavior when there is a sensitive encrypted file directly associated with a specific byte pattern. These indicators include the target visitor's current access frequency and historical average access frequency, the current target data access concentration and the average concentration of historical access targets, as well as the total bytes of the request data for this abnormal access and the number of bytes corresponding to the key byte pattern. The core behavior feature quantification submodule is used to quantify the degree of deviation between the current access frequency and the historical average access frequency to obtain the access frequency deviation characteristic, quantify the degree of deviation between the current target data access concentration and the average concentration of historical access targets to obtain the target concentration deviation characteristic, and divide the number of bytes corresponding to the key byte pattern by the total bytes of the request data for this abnormal access to obtain the abnormality score of the specific byte pattern.

10. The intrusion detection and protection system in a cloud computing environment according to claim 8, characterized in that: The adjustment parameter generation and application module specifically includes: The adjustment parameter calculation submodule is used to call the adjustment parameter calculation formula, substitute the extracted access frequency deviation characteristics, target concentration deviation characteristics and specific byte pattern abnormality score into the formula for weighted calculation, and generate the final dynamic adjustment parameter; The encryption complexity adjustment submodule is used to obtain the current encryption complexity of the sensitive encrypted file and multiply the encryption complexity by the dynamic adjustment parameter to perform positive dynamic enhancement on it; The decryption throughput rate adjustment submodule is used to obtain the current decryption throughput rate of the target visitor and divide the decryption throughput rate by the dynamic adjustment parameter to perform reverse dynamic restriction on it.

Images