An Intrusion Detection and Prevention Method in a Cloud Computing Environment

Abstract

This invention discloses an intrusion detection and prevention method and system in a cloud computing environment. The method includes: after determining that a cloud database access behavior has abnormal characteristics, identifying the target visitor of this access behavior, confirming the specific data object accessed, extracting the key byte pattern associated with the specific data object, and simultaneously retrieving and loading the target visitor's historical access records. This invention achieves progressively enhanced protection of sensitive data by dynamically adjusting encryption complexity. Compared with traditional static encryption methods, this solution can improve data security in real time according to the degree of abnormality of access behavior, especially when facing potential brute-force attacks or high-frequency access, effectively increasing the cost of attacks and significantly reducing the risk of data leakage.

Description

Technical Field

[0001] This invention belongs to the field of cloud computing environment security protection technology, and relates to an intrusion detection and protection method in a cloud computing environment. Background Technology

[0002] With the widespread application of cloud computing technology, cloud data security has become a crucial aspect of ensuring business stability and user data privacy. Existing cloud computing environments typically employ intrusion detection and prevention systems to prevent unauthorized access, brute-force attacks, and the leakage of sensitive data. These systems generally identify abnormal access through monitoring access behavior and rule matching, and implement protective measures such as static encryption, access interruption, or rate limiting. While these methods improve data protection capabilities to some extent, traditional static protection methods have shown many limitations in the face of complex and ever-changing threat scenarios.

[0003] In existing technologies, static encryption methods often employ fixed encryption algorithms or key strengths, lacking dynamic adjustment capabilities. This prevents the system from providing real-time protection for sensitive data based on risk levels when faced with abnormal access. Furthermore, while access interruption, a common protection measure, can quickly block potential threats, it may lead to business disruptions and impact user experience and service quality if normal access behavior is misjudged. Simultaneously, traditional rate limiting methods typically use fixed-value adjustments, failing to flexibly adapt to the degree of abnormality in access behavior, resulting in low efficiency in preventing high-risk access. Summary of the Invention

[0004] To address the aforementioned problems, the technical solution adopted by this invention is: an intrusion detection and protection method in a cloud computing environment, comprising the following steps:

[0005] S1: After determining that a certain cloud database access behavior has abnormal characteristics, the target visitor of this access behavior is identified, the specific data object accessed is confirmed, the key byte pattern associated with the specific data object is extracted, and the historical access records of the target visitor are retrieved and loaded.

[0006] S2: Parse the target visitor's historical access records and determine whether the target visitor's access frequency for the current key byte pattern and its similar patterns is greater than a preset threshold. If the target visitor's access frequency for the current key byte pattern and its similar patterns exceeds the preset threshold, mark the key byte pattern and its similar patterns as a specific byte pattern and proceed to S3; otherwise, return to S1.

[0007] S3: Analyze and determine whether there are sensitive encrypted files in the cloud database that are directly associated with a specific byte pattern. If there are sensitive encrypted files that are directly associated with a specific byte pattern, combine the target visitor's historical access records and current access behavior to extract the core behavioral features of the historical access records and current access behavior, and proceed to S4; otherwise, return to S1.

[0008] S4: Based on the extracted core behavioral features, dynamic adjustment parameters are generated comprehensively. Based on the dynamic adjustment parameters, the encryption complexity of sensitive encrypted files is dynamically enhanced in a positive direction, and the decryption throughput rate of the target visitor is dynamically limited in a reverse direction, so as to realize intrusion detection and protection in the cloud computing environment.

[0009] Furthermore: the key byte pattern and its similar patterns refer to a specific byte sequence related to a specific data object in the current access behavior, as well as other byte patterns that are similar to or related to the specific byte sequence;

[0010] Similar patterns include byte sequences that partially match the key byte pattern in structure, patterns that are functionally or logically related but have been encoded or encrypted, and potential association patterns inferred from the target visitor's historical behavior.

[0011] Furthermore, the core behavioral features for extracting historical access records and current access behavior include: access frequency deviation features, target concentration deviation features, and specific byte pattern anomaly scores.

[0012] Furthermore: the process of analyzing whether there are sensitive encrypted files directly associated with a specific byte pattern in the cloud database, and if so, extracting the core behavioral characteristics of the target visitor by combining their historical access records and current access behavior, is as follows:

[0013] Perform matching analysis on specific byte patterns to determine whether there are sensitive encrypted files in the cloud database that are directly associated with specific byte patterns;

[0014] If a sensitive encrypted file directly associated with a specific byte pattern is identified, key access behavior indicators are extracted by combining the target visitor's historical access records and current access behavior. These indicators include the target visitor's current access frequency and historical average access frequency, current target data access concentration and historical average access target concentration, as well as the total number of bytes of requested data and the number of bytes corresponding to the key byte pattern in this abnormal access. Core behavioral features of historical access records and current access behavior are extracted using quantitative methods.

[0015] Furthermore, the core behavioral features extracted from historical access records and current access behavior using quantification methods include:

[0016] Quantify the degree of deviation between the current access frequency and the historical average access frequency to derive access frequency deviation characteristics.

[0017] Quantify the degree of deviation between the current concentration of target data access and the average concentration of historical target access to derive the target concentration deviation characteristics.

[0018] Divide the number of bytes corresponding to the key byte pattern by the total number of bytes of the request data in this abnormal access to obtain the abnormality score of the specific byte pattern.

[0019] Furthermore: the process of generating dynamic adjustment parameters based on the extracted core behavioral features, and then dynamically enhancing the encryption complexity of sensitive encrypted files and dynamically limiting the decryption throughput rate of the target visitor based on these parameters, is as follows:

[0020] The formula for calculating the adjustment parameters is called, and the extracted access frequency deviation features, target concentration deviation features, and specific byte pattern anomaly scores are substituted into the formula for weighted calculation to generate the final dynamic adjustment parameters.

[0021] Obtain the current encryption complexity of the sensitive encrypted file, and multiply the encryption complexity by a dynamic adjustment parameter to perform positive dynamic enhancement.

[0022] Obtain the current decryption throughput rate of the target visitor and divide the decryption throughput rate by the dynamic adjustment parameter to perform reverse dynamic limiting on it.

[0023] Furthermore: the formula for calculating the adjustment parameter is as follows:

[0024]

[0025] Where: D refers to the dynamic adjustment parameter, F current This refers to the current access frequency, F. avg This refers to the historical average access frequency. This refers to the access frequency deviation feature, where w1 is the weighting coefficient of the access frequency deviation feature, and T... current This refers to the current concentration of access to target data, T. avg This refers to the average concentration of historical visit targets. This refers to the target concentration deviation characteristic, w2 refers to the weighting coefficient of the target concentration deviation characteristic, and S specific w3 refers to the anomaly score for a specific byte pattern, and w3 refers to the weighting coefficient of the anomaly score for a specific byte pattern.

[0026] In the formula for calculating the adjustment parameters Among them B key This refers to the number of bytes corresponding to the key byte pattern, B totalThis refers to the total number of bytes of request data for this abnormal access.

[0027] An intrusion detection and prevention system in a cloud computing environment includes:

[0028] Data acquisition module: After determining that a certain cloud database access behavior has abnormal characteristics, it is used to locate the target visitor of this access behavior, confirm the specific data object accessed, extract the key byte pattern associated with the specific data object, and retrieve and load the target visitor's historical access records.

[0029] Specific Byte Pattern Determination Module: Used to determine the target visitor's historical access records and assess whether the target visitor's access frequency for the current keyword byte pattern and similar patterns exceeds a preset threshold. If the target visitor's access frequency for the current keyword byte pattern and similar patterns exceeds the threshold, the keyword byte pattern and similar patterns are marked as specific byte patterns, and the process is transferred to the core behavior feature extraction module; otherwise, the process is returned to the data acquisition module.

[0030] Core Behavioral Feature Extraction Module: This module analyzes and determines whether there are sensitive encrypted files in the cloud database that are directly associated with a specific byte pattern. If such files exist, the module combines the target visitor's historical access records and current access behavior to extract their core behavioral features and transfers the module to the adjustment parameter generation and application module. Otherwise, it returns to the data acquisition module.

[0031] The parameter generation and application module is used to generate dynamic adjustment parameters based on the extracted core behavioral features. Based on the dynamic adjustment parameters, the encryption complexity of sensitive encrypted files is dynamically enhanced in a positive direction, and the decryption throughput rate of the target visitor is dynamically limited in a negative direction, so as to realize intrusion detection and protection in the cloud computing environment.

[0032] Furthermore: the core behavioral feature extraction module specifically includes:

[0033] The sensitive encrypted file inspection submodule is used to perform matching analysis on specific byte patterns to determine whether there are sensitive encrypted files in the cloud database that are directly associated with specific byte patterns;

[0034] The behavior indicator extraction submodule is used to extract key access behavior indicators when there are sensitive encrypted files directly associated with a specific byte pattern, by combining the target visitor's historical access records and current access behavior. These indicators include the target visitor's current access frequency and historical average access frequency, current target data access concentration and historical average access target concentration, as well as the total number of bytes of requested data and the number of bytes corresponding to the key byte pattern in this abnormal access.

[0035] The core behavioral feature quantification submodule is used to quantify the degree of deviation between the current access frequency and the historical average access frequency, and to obtain the access frequency deviation feature. It also quantifies the degree of deviation between the current target data access concentration and the historical average concentration of the target, and to obtain the target concentration deviation feature. Finally, it divides the number of bytes corresponding to the key byte pattern by the total number of bytes of the request data in this abnormal access to obtain the abnormality score of the specific byte pattern.

[0036] Furthermore, the adjustment parameter generation and application module specifically includes:

[0037] The adjustment parameter calculation submodule is used to call the adjustment parameter calculation formula, substitute the extracted access frequency deviation features, target concentration deviation features, and specific byte pattern anomaly scores into the formula for weighted calculation, and generate the final dynamic adjustment parameters.

[0038] The encryption complexity adjustment submodule is used to obtain the current encryption complexity of sensitive encrypted files and multiply the encryption complexity by a dynamic adjustment parameter to positively and dynamically enhance it.

[0039] The decryption throughput rate adjustment submodule is used to obtain the current decryption throughput rate of the target visitor and divide the decryption throughput rate by the dynamic adjustment parameter to dynamically limit it in reverse.

[0040] The present invention provides an intrusion detection and prevention method and system in a cloud computing environment, which has the following advantages:

[0041] First, this invention achieves progressively enhanced protection for sensitive data by dynamically adjusting encryption complexity. Compared to traditional static encryption methods, this solution can improve data security in real time based on the degree of anomaly in access behavior. Especially when facing potential brute-force attacks or high-frequency access, it effectively increases the cost of attacks and significantly reduces the risk of data leakage.

[0042] Secondly, the reverse dynamic limitation of the throughput rate ensures that abnormal visitors cannot quickly obtain sensitive information within a short period of time, buying valuable time for further system analysis and response. Compared with the traditional method of directly interrupting access, this solution avoids business interruption problems that may be caused by misjudgment, and maximizes the balance between security and user experience.

[0043] Furthermore, this invention employs feature extraction and bias calculation based on access behavior to effectively identify high-risk behaviors and dynamically adjust protection strategies, exhibiting strong flexibility and adaptability, making it particularly suitable for complex scenarios in multi-tenant architectures within cloud computing environments. Through intelligent, progressive protection, this invention ensures data security while minimizing interference with normal business operations. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 A flowchart of the method provided in the embodiments of the present invention;

[0046] Figure 2 This is a flowchart illustrating the method for obtaining the core behavioral characteristics of a target visitor in the embodiments of the present invention.

[0047] Figure 3 A flowchart illustrating the dynamic adjustment of encryption complexity of sensitive encrypted files and decryption throughput rate of target visitors in the method provided in this embodiment of the invention.

[0048] Figure 4 Application architecture diagram of the system provided in the embodiments of the present invention;

[0049] Figure 5 This is a structural block diagram of the core behavioral feature extraction module in the system provided in the embodiments of the present invention;

[0050] Figure 6 This is a structural block diagram of the adjustment parameter generation and application module in the system provided in the embodiment of the present invention. Detailed Implementation

[0051] It should be noted that, unless otherwise specified, the embodiments and features in the embodiments of the present invention can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and embodiments.

[0052] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The following description of at least one exemplary embodiment is merely illustrative and is in no way intended to limit the present invention or its application or use. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0053] Figure 1 A flowchart of the method provided by an embodiment of the present invention is shown.

[0054] An intrusion detection and prevention method in a cloud computing environment includes the following steps:

[0055] S1: After determining that a certain cloud database access behavior has abnormal characteristics, the target visitor of this access behavior is identified, the specific data object accessed is confirmed, the key byte pattern associated with the specific data object is extracted, and the historical access records of the target visitor are retrieved and loaded.

[0056] S2: Parse the target visitor's historical access records, determine whether the target visitor's access frequency for the current key byte pattern and similar patterns is greater than a preset threshold, and perform the first intrusion detection judgment; if the target visitor's access frequency for the current key byte pattern and similar patterns exceeds the threshold, mark the key byte pattern and similar patterns as a specific byte pattern and proceed to S3, otherwise return to S1.

[0057] S3: Analyze and determine whether there are sensitive encrypted files in the cloud database that are directly associated with a specific byte pattern. Perform a second intrusion detection judgment. If there are sensitive encrypted files that are directly associated with a specific byte pattern, combine the target visitor's historical access records and current access behavior to extract its core behavioral characteristics and proceed to S4. Otherwise, return to S1.

[0058] S4: Based on the extracted core behavioral features, dynamic adjustment parameters are generated comprehensively. Based on the dynamic adjustment parameters, the encryption complexity of sensitive encrypted files is dynamically enhanced in a positive direction, and the decryption throughput rate of the target visitor is dynamically limited in a reverse direction, so as to realize intrusion detection and protection in the cloud computing environment.

[0059] Steps S1 / S2 / S3 / S4 are executed sequentially;

[0060] Specifically, the intrusion detection and prevention method in a cloud computing environment includes the following steps:

[0061] Step S1: After determining that a certain cloud database access behavior has abnormal characteristics, the target visitor of this access behavior is identified, the specific data object accessed is confirmed, the key byte pattern associated with the specific data object is extracted, and the historical access records of the target visitor are retrieved and loaded.

[0062] In this embodiment of the invention, the cloud database is one of the core components of the cloud computing environment. As part of cloud computing resources, it provides users with flexible data storage and management services. It features on-demand allocation, high availability, and a multi-tenant architecture, supporting dynamic scaling of applications, data analysis, and cross-regional data synchronization within the cloud computing environment. The cloud database typically works in conjunction with cloud computing resources, storage resources, and network resources to provide users with an integrated cloud service solution.

[0063] Determining whether access behavior exhibits abnormal characteristics can be achieved through various existing technologies, which are widely used in current cloud computing and database management. Access frequency detection is a common method, analyzing whether the number of requests per unit time significantly exceeds the historical average or a set threshold to determine if access is abnormal. For example, a sliding window counting method can be used to count access frequency, and upper and lower limits can be set based on historical distribution. Behavioral pattern detection focuses on deviations from access patterns, such as whether the concentration of access to certain sensitive data objects has increased abnormally or whether the access behavior contains specific illegal patterns, such as SQL injection strings. This type of detection can be based on rule matching (such as regular expressions) or machine learning methods, analyzing the characteristics of access sequences to identify access behaviors that deviate from normal patterns.

[0064] Identifying the specific data object accessed by the user requires extracting the target identifier (such as a database table name, field name, or file path) from the access request. This identifier, combined with system log records and access metadata, allows for precise location of the access target. Extracting key byte patterns relies on byte-level analysis of the accessed data content to identify specific byte sequences or patterns associated with the target data object, such as file header identifiers, encrypted data fragments, or common encoding characteristics.

[0065] Historical access records are logs of all interactions by a target visitor within the cloud database. These records are typically generated automatically by a log system and are used to track visitor behavior patterns and assess potential anomalies. They should include visitor identification information, such as user ID and IP address, as well as a timestamp for each access, to analyze access frequency and behavior distribution. Records should also include target data identifiers, such as database table names, field names, or file paths, to pinpoint the specific data object accessed. The type of access operation, such as query, insert, update, or delete, is also crucial for identifying access intent and behavioral nature. These records should also store specific data related to the access request, such as query conditions, parameters, or feature summaries of uploaded data, to support key byte pattern extraction and correlation analysis. Furthermore, the total number of bytes in each access request and the number of bytes involved in key byte patterns should also be reflected in the historical records to provide a basis for assessing the anomalies of specific byte patterns. By analyzing these records, key access behavior indicators can be extracted, including a comparison of the target visitor's current access frequency with the historical average access frequency, the difference between the current concentration of target data access and the historical average concentration of target data access, and the proportion of keyword byte patterns in the current abnormal access request data. Combining this information with the current abnormal access behavior provides a precise basis for generating subsequent dynamic protection and adjustment strategies.

[0066] Key byte patterns refer to specific byte sequences within data content during access. These sequences possess certain identifiable or sensitive characteristics, such as file signatures, encrypted marker data, and field value encoding patterns. Key byte pattern extraction can be combined with content scanning, feature matching algorithms, or predefined rules to provide a basis for subsequent anomaly analysis and correlation determination.

[0067] Furthermore, the intrusion detection and protection method in the cloud computing environment also includes the following steps:

[0068] Step S2: Parse the target visitor's historical access records and determine whether the target visitor's access frequency for the current key byte pattern and its similar patterns exceeds a preset threshold. If the target visitor's access frequency for the current key byte pattern and its similar patterns exceeds the threshold, mark the key byte pattern and its similar patterns as a specific byte pattern and proceed to S3. Otherwise, return to the specific process of S1 as follows.

[0069] The key byte pattern and its similar patterns refer to a specific byte sequence related to a specific data object in the current access behavior, as well as other byte patterns that are similar to or related to the specific byte sequence.

[0070] Similar patterns include byte sequences that partially match the key byte pattern in structure, patterns that are functionally or logically related but have been encoded or encrypted, and potential association patterns inferred from the target visitor's historical behavior.

[0071] In this embodiment of the invention, the preset threshold is typically set based on statistical analysis of the target visitor's historical access behavior and a summary of patterns in typical access behavior during normal system operation. Specifically, the average access frequency of a specific keyword byte pattern and similar patterns can be calculated by analyzing the access frequency distribution in historical access data, and a reasonable upper limit can be set as the threshold by combining the standard deviation or quantile of the access frequency. Furthermore, the threshold can be dynamically adjusted, for example, in real time based on the overall system load, the visitor's permission level, or the sensitivity of the target data object, to ensure that the threshold can effectively identify abnormal behavior while minimizing false alarms.

[0072] Assessing whether a target visitor's access frequency for the current keyword byte pattern and similar patterns exceeds a preset threshold can be achieved through the following steps: First, extract all access events involving the keyword byte pattern and similar patterns from the target visitor's historical access records, count the number of accesses within each time window, and calculate the ratio deviation between the current access frequency and the historical average access frequency. Then, compare the deviation result with the preset threshold. If the current access frequency is significantly higher than the historical average and exceeds the preset threshold, it is determined to be abnormal access behavior.

[0073] The significance of marking key byte patterns and similar patterns as specific byte patterns lies in clearly identifying potentially high-risk data characteristics involved in the current access of a target visitor. This marking is not only used for subsequent dynamic adjustment strategies, such as limiting the access rate of the target visitor or increasing the encryption complexity of related data objects, but also provides data support for long-term security monitoring. By recording specific byte patterns and their associated information, foundational data can be provided for further threat intelligence analysis and anomaly detection model optimization. The definition of key byte patterns and similar patterns originates from feature extraction and pattern matching of accessed data content. Specifically, key byte patterns are byte sequence features extracted from target data objects, typically including data headers, encryption identifiers, or encoding patterns. Similar patterns are related patterns inferred through structural matching, semantic analysis, or historical behavior. For example, edit distance or hash value matching algorithms can be used to identify byte sequences that are partially identical or modified to key byte patterns, and machine learning models can be used to analyze pattern regularities in the visitor's historical behavior to infer potential associated patterns. Ultimately, the extraction and identification of these patterns are accomplished through a combination of rule matching, statistical analysis, and intelligent algorithms, laying the technical foundation for the analysis and handling of abnormal access behavior.

[0074] Furthermore, the intrusion detection and protection method in the cloud computing environment also includes the following steps:

[0075] Step S3: Analyze and determine whether there are sensitive encrypted files in the cloud database that are directly associated with a specific byte pattern. If there are sensitive encrypted files that are directly associated with a specific byte pattern, combine the target visitor's historical access records and current access behavior to extract its core behavioral features, including access frequency deviation features, target concentration deviation features and specific byte pattern anomaly scores, and proceed to S4; otherwise, return to S1.

[0076] Specifically, Figure 2 A flowchart is shown to obtain the core behavioral characteristics of the target visitor.

[0077] The process involves analyzing whether sensitive encrypted files directly associated with a specific byte pattern exist in the cloud database. If so, by combining the target visitor's historical access records and current access behavior, core behavioral characteristics are extracted, including access frequency deviation characteristics, target concentration deviation characteristics, and specific byte pattern anomaly scores. This includes the following steps:

[0078] Step S301: Perform matching analysis on specific byte patterns to check whether there are sensitive encrypted files in the cloud database that are directly associated with specific byte patterns;

[0079] Step S302: If it is determined that the target visitor exists, extract key access behavior indicators by combining the target visitor's historical access records and current access behavior, including the target visitor's current access frequency and historical average access frequency, current target data access concentration and historical average access target concentration, as well as the total number of bytes of request data and the number of bytes corresponding to the key byte pattern in this abnormal access.

[0080] Step S303: Quantify the degree of deviation between the current access frequency and the historical average access frequency to obtain access frequency deviation characteristics; quantify the degree of deviation between the current target data access concentration and the historical average concentration of access targets to obtain target concentration deviation characteristics; divide the number of bytes corresponding to the key byte pattern by the total number of bytes of request data in this abnormal access to obtain a specific byte pattern abnormality score.

[0081] In this embodiment of the invention, the correlation of sensitive encrypted files is determined by matching and analyzing specific byte patterns with the metadata and data content of encrypted files in the database. Specific methods include using hash value comparison, byte sequence feature matching, and the identification information of encrypted files (such as encryption algorithm type and file header features) for correlation verification. The system extracts these features and compares them one by one to determine whether a specific byte pattern is directly related to a sensitive encrypted file. If a correlation is confirmed, the system marks the sensitive encrypted file as an analysis target for subsequent behavioral feature extraction and risk assessment.

[0082] The extraction of the target visitor's current access frequency and historical average access frequency is based on timestamps and access event statistics in the log records. The current access frequency is determined by calculating the number of requests per unit time; combined with historical access records, the average access frequency for the same specific byte pattern is calculated to quantify access frequency deviation characteristics. The current target data access concentration and the historical average target access concentration are obtained by analyzing the access distribution of different data objects by visitors within a specific time period. The current concentration can be obtained by calculating the proportion of a visitor's access to a particular target data object, while the historical average concentration is calculated based on the distribution pattern of long-term access data. The total number of bytes in the request data and the number of bytes corresponding to the key byte pattern in abnormal accesses are obtained by directly counting the total data length of the current request and the number of bytes matching the specific byte pattern, respectively.

[0083] The selection of these features has clear analytical significance. The access frequency deviation feature quantifies the degree of deviation between a visitor's current access behavior and their historical behavior, used to detect abnormal access. The target concentration deviation feature identifies potential threatening behaviors, such as excessive requests for sensitive data, by recognizing whether access behavior is highly concentrated on a specific data object. The specific byte pattern anomaly score directly reflects the proportion of abnormal byte patterns in the current request, indicating the risk of leakage of potentially sensitive information in the data. By integrating these features, the system can more accurately assess the abnormal behavior of target visitors, providing data support for dynamic adjustment and risk prevention.

[0084] Furthermore, the intrusion detection and protection method in the cloud computing environment also includes the following steps:

[0085] Step S4: Based on the extracted core behavioral features, generate dynamic adjustment parameters, and based on the dynamic adjustment parameters, positively and dynamically enhance the encryption complexity of sensitive encrypted files, and negatively and dynamically limit the decryption throughput rate of the target visitor.

[0086] Specifically, Figure 3 A flowchart is shown illustrating the dynamic adjustment of encryption complexity for sensitive encrypted files and decryption throughput for target visitors.

[0087] Specifically, based on the extracted core behavioral features, dynamic adjustment parameters are generated. These parameters are then used to positively and dynamically enhance the encryption complexity of sensitive encrypted files, and to negatively and dynamically limit the decryption throughput rate of the target user. The process includes the following steps:

[0088] Step S401: Call the adjustment parameter calculation formula, substitute the extracted access frequency deviation features, target concentration deviation features and specific byte pattern anomaly scores into the formula for weighted calculation, and generate the final dynamic adjustment parameters.

[0089] Step S402: Obtain the current encryption complexity of the sensitive encrypted file, and multiply the encryption complexity by the dynamic adjustment parameter to perform positive dynamic enhancement.

[0090] Step S403: Obtain the current decryption throughput rate of the target visitor and divide the decryption throughput rate by the dynamic adjustment parameter to perform reverse dynamic limiting on it.

[0091] The formula for calculating the adjustment parameter is:

[0092]

[0093] Where: D refers to the dynamic adjustment parameter, F current This refers to the current access frequency, F. avg This refers to the historical average access frequency. This refers to the access frequency deviation feature, where w1 is the weighting coefficient of the access frequency deviation feature, and T... current This refers to the current concentration of access to target data, T. avg This refers to the average concentration of historical visit targets. This refers to the target concentration deviation characteristic, w2 refers to the weighting coefficient of the target concentration deviation characteristic, and S specific w3 refers to the anomaly score for a specific byte pattern, and w3 refers to the weighting coefficient of the anomaly score for a specific byte pattern.

[0094] In the formula for calculating the adjustment parameters Among them B key This refers to the number of bytes corresponding to the key byte pattern, B total This refers to the total number of bytes of request data for this abnormal access.

[0095] For dynamic adjustment of encryption complexity and decryption throughput, the calculation method is not limited to simple multiplication or division operations; more flexible and complex calculation methods can be combined. For example, nonlinear functions (such as exponential or logarithmic functions) can be used to enhance the sensitivity of adjustment, allowing for gentle adjustments when the deviation is small, and rapid increases in adjustment magnitude when the deviation is large. Furthermore, different adjustment strategies can be set through piecewise functions, such as maintaining the existing encryption complexity or throughput at low deviations, adjusting proportionally in the medium to high deviation range, and imposing fixed value limits or breakpoint protection when exceeding the limit. For adjusting encryption complexity, a dynamic parameter superposition mechanism can be introduced, such as adding additional encryption iterations or obfuscation layers to the existing complexity, thereby achieving more refined dynamic enhancement. Such a design not only improves the flexibility of adjustment but also better adapts to the security needs and performance requirements of different scenarios.

[0096] In this embodiment of the invention, obtaining the current encryption complexity of the sensitive encrypted file and multiplying it by a dynamic adjustment parameter for positive dynamic enhancement means that by increasing the strength of the encryption algorithm (e.g., upgrading from AES-128 to AES-256) or extending the length of the encryption key, sensitive data becomes more difficult to crack under potential threats. This adjustment method ensures that when access behavior is judged as abnormal, the protection layer of sensitive data is dynamically strengthened, effectively reducing the security risks caused by decryption attempts or data leakage. Obtaining the current decryption throughput rate of the target visitor and dividing it by the dynamic adjustment parameter for reverse dynamic limitation means that by reducing the speed of data decryption, the transmission rate of sensitive information is slowed down, thereby buying more time for the system's threat assessment and response. This limitation method avoids the misjudgment and business impact that may be caused by directly interrupting access, and adopts a gradual approach to dynamically limit the behavior of potential threat actors. The advantage of this adjustment method is that it realizes a flexible dynamic protection mechanism, which can effectively protect sensitive data without completely interrupting access. Compared to traditional access blocking or static encryption strategies, this dynamic adjustment mode is more intelligent and precise. It can adjust the strategy in real time according to the degree of abnormality of the visitor's behavior, which can both ensure data security and minimize the impact on normal users.

[0097] This technology has broad application prospects, especially in fields with extremely high data security requirements such as finance, healthcare, and government. For example, banking systems can dynamically increase the encryption level of transaction data when abnormal transfer requests are detected, while simultaneously limiting the data read rate of abnormal users, thereby reducing the potential risk of financial fraud. Furthermore, it can be applied to multi-tenant scenarios in cloud computing environments, dynamically protecting sensitive files and preventing malicious tenants from abusing resources.

[0098] In practice, suppose the system detects that a user's access frequency to an encrypted file suddenly and significantly exceeds its historical average, while the access concentration is biased towards sensitive fields of that file. After dynamically adjusting parameters and calculating, the system determines the severity of the access anomaly to be high. Therefore, the system increases the encryption complexity of the file from a medium-level encryption algorithm to a high-strength encryption algorithm. Simultaneously, the user's decryption rate is significantly reduced, allowing only a very small amount of data to be read per second. This adjustment not only effectively protects the security of sensitive data but also provides ample time for further analysis and response to the user's access behavior. In this way, the system achieves a good balance between protective flexibility and data security.

[0099] The technical solution of the present invention will be described in detail below through a specific example:

[0100] A cloud database system detected abnormal access behavior from a user to a specific encrypted file. Analysis revealed that the user's current access frequency was 120 times per minute, while the historical average was 50 times per minute. Further examination of the user's access concentration showed that 80% of their access requests were to this specific encrypted file, compared to the historical average concentration of only 50%. Furthermore, the key byte pattern in the current access request was 400 bytes, while the total data size of the entire request was 2000 bytes.

[0101] By quantifying the deviations in access frequency, access concentration, and key byte pattern proportion, the system comprehensively derives a dynamic adjustment parameter of 3.2, indicating a high degree of anomaly in the current behavior. To address this anomalous access, the system first obtains the encryption complexity of the currently encrypted file. Assuming an initial encryption complexity of 128 (corresponding to the key length of AES-128), the system multiplies this value by the dynamic adjustment parameter 3.2, dynamically adjusting the encryption complexity to 409.6, indicating a significant increase in key length. According to the system design, this increased complexity can be achieved by increasing the number of encryption operation iterations or upgrading the algorithm parameters of the key strength, thereby making file protection more robust.

[0102] The system then detected that the user's current decryption throughput rate was 100MB / s. Based on dynamic adjustment parameters, the system decided to reduce this rate to 31.25MB / s to significantly slow down data transmission. This adjustment effectively prevented potential high-frequency data leaks while providing sufficient time for subsequent monitoring and analysis. Through these dynamic adjustments, the encryption strength of sensitive files was dynamically enhanced, and the access behavior of abnormal users was effectively restricted. At the same time, the system did not completely interrupt the user's access, thus avoiding excessive interference with potential normal business operations. This progressive dynamic response strategy balances security and business continuity, demonstrating the advantages of intelligent protection.

[0103] Further, Figure 4 An application architecture diagram of the system provided in an embodiment of the present invention is shown.

[0104] In another preferred embodiment of the present invention, the intrusion detection and prevention system in a cloud computing environment includes:

[0105] The data acquisition module 100 is used to identify the target visitor of a cloud database access behavior after determining that the access behavior has abnormal characteristics, confirm the specific data object accessed, extract the key byte pattern associated with the specific data object, and retrieve and load the target visitor's historical access records.

[0106] In this embodiment of the invention, the cloud database is one of the core components of the cloud computing environment. As part of cloud computing resources, it provides users with flexible data storage and management services. It features on-demand allocation, high availability, and a multi-tenant architecture, supporting dynamic scaling of applications, data analysis, and cross-regional data synchronization within the cloud computing environment. The cloud database typically works in conjunction with cloud computing resources, storage resources, and network resources to provide users with an integrated cloud service solution.

[0107] Determining whether access behavior exhibits abnormal characteristics can be achieved through various existing technologies, which are widely used in current cloud computing and database management. Access frequency detection is a common method, analyzing whether the number of requests per unit time significantly exceeds the historical average or a set threshold to determine if access is abnormal. For example, a sliding window counting method can be used to count access frequency, and upper and lower limits can be set based on historical distribution. Behavioral pattern detection focuses on deviations from access patterns, such as whether the concentration of access to certain sensitive data objects has increased abnormally or whether the access behavior contains specific illegal patterns, such as SQL injection strings. This type of detection can be based on rule matching (such as regular expressions) or machine learning methods, analyzing the characteristics of access sequences to identify access behaviors that deviate from normal patterns.

[0108] Identifying the specific data object accessed by the user requires extracting the target identifier (such as a database table name, field name, or file path) from the access request. This identifier, combined with system log records and access metadata, allows for precise location of the access target. Extracting key byte patterns relies on byte-level analysis of the accessed data content to identify specific byte sequences or patterns associated with the target data object, such as file header identifiers, encrypted data fragments, or common encoding characteristics.

[0109] Historical access records are logs of all interactions by a target visitor within the cloud database. These records are typically generated automatically by a log system and are used to track visitor behavior patterns and assess potential anomalies. They should include visitor identification information, such as user ID and IP address, as well as a timestamp for each access, to analyze access frequency and behavior distribution. Records should also include target data identifiers, such as database table names, field names, or file paths, to pinpoint the specific data object accessed. The type of access operation, such as query, insert, update, or delete, is also crucial for identifying access intent and behavioral nature. These records should also store specific data related to the access request, such as query conditions, parameters, or feature summaries of uploaded data, to support key byte pattern extraction and correlation analysis. Furthermore, the total number of bytes in each access request and the number of bytes involved in key byte patterns should also be reflected in the historical records to provide a basis for assessing the anomalies of specific byte patterns. By analyzing these records, key access behavior indicators can be extracted, including a comparison of the target visitor's current access frequency with the historical average access frequency, the difference between the current concentration of target data access and the historical average concentration of target data access, and the proportion of keyword byte patterns in the current abnormal access request data. Combining this information with the current abnormal access behavior provides a precise basis for generating subsequent dynamic protection and adjustment strategies.

[0110] Key byte patterns refer to specific byte sequences within data content during access. These sequences possess certain identifiable or sensitive characteristics, such as file signatures, encrypted marker data, and field value encoding patterns. Key byte pattern extraction can be combined with content scanning, feature matching algorithms, or predefined rules to provide a basis for subsequent anomaly analysis and correlation determination.

[0111] Furthermore, the intrusion detection and prevention system in the cloud computing environment also includes:

[0112] The specific byte pattern determination module 200 is used to determine the target visitor's historical access records and assess whether the target visitor's access frequency for the current keyword byte pattern and similar patterns exceeds a preset threshold. If the target visitor's access frequency for the current keyword byte pattern and similar patterns exceeds the threshold, the keyword byte pattern and similar patterns are marked as specific byte patterns and transferred to the core behavior feature extraction module; otherwise, it returns to the data acquisition module.

[0113] The key byte pattern and its similar patterns refer to a specific byte sequence related to a specific data object in the current access behavior and other byte patterns that are similar to or related to it;

[0114] Similar patterns include byte sequences that partially match the key byte pattern in structure, patterns that are functionally or logically related but have been encoded or encrypted, and potential association patterns inferred from the target visitor's historical behavior.

[0115] In this embodiment of the invention, the preset threshold is typically set based on statistical analysis of the target visitor's historical access behavior and a summary of patterns in typical access behavior during normal system operation. Specifically, the average access frequency of a specific keyword byte pattern and similar patterns can be calculated by analyzing the access frequency distribution in historical access data, and a reasonable upper limit can be set as the threshold by combining the standard deviation or quantile of the access frequency. Furthermore, the threshold can be dynamically adjusted, for example, in real time based on the overall system load, the visitor's permission level, or the sensitivity of the target data object, to ensure that the threshold can effectively identify abnormal behavior while minimizing false alarms.

[0116] Assessing whether a target visitor's access frequency for the current keyword byte pattern and similar patterns exceeds a preset threshold can be achieved through the following steps: First, extract all access events involving the keyword byte pattern and similar patterns from the target visitor's historical access records, count the number of accesses within each time window, and calculate the ratio deviation between the current access frequency and the historical average access frequency. Then, compare the deviation result with the preset threshold. If the current access frequency is significantly higher than the historical average and exceeds the preset threshold, it is determined to be abnormal access behavior.

[0117] The significance of marking key byte patterns and similar patterns as specific byte patterns lies in clearly identifying potentially high-risk data characteristics involved in the current access of a target visitor. This marking is not only used for subsequent dynamic adjustment strategies, such as limiting the access rate of the target visitor or increasing the encryption complexity of related data objects, but also provides data support for long-term security monitoring. By recording specific byte patterns and their associated information, foundational data can be provided for further threat intelligence analysis and anomaly detection model optimization. The definition of key byte patterns and similar patterns originates from feature extraction and pattern matching of accessed data content. Specifically, key byte patterns are byte sequence features extracted from target data objects, typically including data headers, encryption identifiers, or encoding patterns. Similar patterns are related patterns inferred through structural matching, semantic analysis, or historical behavior. For example, edit distance or hash value matching algorithms can be used to identify byte sequences that are partially identical or modified to key byte patterns, and machine learning models can be used to analyze pattern regularities in the visitor's historical behavior to infer potential associated patterns. Ultimately, the extraction and identification of these patterns are accomplished through a combination of rule matching, statistical analysis, and intelligent algorithms, laying the technical foundation for the analysis and handling of abnormal access behavior.

[0118] Furthermore, the intrusion detection and prevention system in the cloud computing environment also includes:

[0119] The core behavioral feature extraction module 300 is used to analyze and determine whether there are sensitive encrypted files in the cloud database that are directly associated with a specific byte pattern. If there are sensitive encrypted files that are directly associated with a specific byte pattern, the core behavioral features of the target visitor are extracted by combining the target visitor's historical access records and current access behavior, and then transferred to the adjustment parameter generation and application module; otherwise, it returns to the data acquisition module.

[0120] Specifically, Figure 5 The diagram shows the structural block diagram of the core behavioral feature extraction module 300 in the system provided by the embodiment of the present invention.

[0121] In a preferred embodiment provided by the present invention, the core behavioral feature extraction module 300 specifically includes:

[0122] The sensitive encrypted file inspection submodule 301 is used to perform matching analysis on specific byte patterns to check whether there are sensitive encrypted files in the cloud database that are directly associated with specific byte patterns;

[0123] The behavior indicator extraction submodule 302 is used to extract key access behavior indicators by combining the target visitor's historical access records and current access behavior if it is determined that they exist. These indicators include the target visitor's current access frequency and historical average access frequency, current target data access concentration and historical average access target concentration, as well as the total number of bytes of request data and the number of bytes corresponding to the key byte pattern in this abnormal access.

[0124] The core behavioral feature quantification unit 303 is used to quantify the degree of deviation between the current access frequency and the historical average access frequency to obtain the access frequency deviation feature, quantify the degree of deviation between the current target data access concentration and the historical average concentration of the target to obtain the target concentration deviation feature, and divide the number of bytes corresponding to the key byte pattern by the total number of bytes of the request data of this abnormal access to obtain the abnormality score of the specific byte pattern.

[0125] In this embodiment of the invention, the correlation of sensitive encrypted files is determined by matching and analyzing specific byte patterns with the metadata and data content of encrypted files in the database. Specific methods include using hash value comparison, byte sequence feature matching, and the identification information of encrypted files (such as encryption algorithm type and file header features) for correlation verification. The system extracts these features and compares them one by one to determine whether a specific byte pattern is directly related to a sensitive encrypted file. If a correlation is confirmed, the system marks the sensitive encrypted file as an analysis target for subsequent behavioral feature extraction and risk assessment.

[0126] The extraction of the target visitor's current access frequency and historical average access frequency is based on timestamps and access event statistics in the log records. The current access frequency is determined by calculating the number of requests per unit time; combined with historical access records, the average access frequency for the same specific byte pattern is calculated to quantify access frequency deviation characteristics. The current target data access concentration and the historical average target access concentration are obtained by analyzing the access distribution of different data objects by visitors within a specific time period. The current concentration can be obtained by calculating the proportion of a visitor's access to a particular target data object, while the historical average concentration is calculated based on the distribution pattern of long-term access data. The total number of bytes in the request data and the number of bytes corresponding to the key byte pattern in abnormal accesses are obtained by directly counting the total data length of the current request and the number of bytes matching the specific byte pattern, respectively.

[0127] The selection of these features has clear analytical significance. The access frequency deviation feature quantifies the degree of deviation between a visitor's current access behavior and their historical behavior, used to detect abnormal access. The target concentration deviation feature identifies potential threatening behaviors, such as excessive requests for sensitive data, by recognizing whether access behavior is highly concentrated on a specific data object. The specific byte pattern anomaly score directly reflects the proportion of abnormal byte patterns in the current request, indicating the risk of leakage of potentially sensitive information in the data. By integrating these features, the system can more accurately assess the abnormal behavior of target visitors, providing data support for dynamic adjustment and risk prevention.

[0128] Furthermore, the intrusion detection and prevention system in the cloud computing environment also includes:

[0129] The adjustment parameter generation and application module 400 is used to generate dynamic adjustment parameters based on the extracted core behavioral features, and to dynamically enhance the encryption complexity of sensitive encrypted files in a positive direction and dynamically limit the decryption throughput rate of the target visitor in a reverse direction based on the dynamic adjustment parameters.

[0130] Specifically, Figure 6 The diagram shows a structural block diagram of the adjustment parameter generation and application module 400 in the system provided by an embodiment of the present invention.

[0131] In a preferred embodiment of the present invention, the adjustment parameter generation and application module 400 specifically includes:

[0132] The adjustment parameter calculation unit 401 is used to call the adjustment parameter calculation formula, substitute the extracted access frequency deviation features, target concentration deviation features and specific byte pattern anomaly scores into the formula for weighted calculation, and generate the final dynamic adjustment parameters.

[0133] The encryption complexity adjustment unit 402 is used to obtain the current encryption complexity of the sensitive encrypted file and multiply the encryption complexity by a dynamic adjustment parameter to positively and dynamically enhance it.

[0134] The decryption throughput rate adjustment unit 403 is used to obtain the current decryption throughput rate of the target visitor and divide the decryption throughput rate by the dynamic adjustment parameter to perform reverse dynamic limitation on it.

[0135] The formula for calculating the adjustment parameter is:

[0136]

[0137] Where: D refers to the dynamic adjustment parameter, F current This refers to the current access frequency, F. avg This refers to the historical average access frequency. This refers to the access frequency deviation feature, where w1 is the weighting coefficient of the access frequency deviation feature, and T... current This refers to the current concentration of access to target data, T. avg This refers to the average concentration of historical visit targets. This refers to the target concentration deviation characteristic, w2 refers to the weighting coefficient of the target concentration deviation characteristic, and S specific w3 refers to the anomaly score for a specific byte pattern, and w3 refers to the weighting coefficient of the anomaly score for a specific byte pattern.

[0138] In the formula for calculating the adjustment parameters Among them B key This refers to the number of bytes corresponding to the key byte pattern, B total This refers to the total number of bytes of request data for this abnormal access.

[0139] For dynamic adjustment of encryption complexity and decryption throughput, the calculation method is not limited to simple multiplication or division operations; more flexible and complex calculation methods can be combined. For example, nonlinear functions (such as exponential or logarithmic functions) can be used to enhance the sensitivity of adjustment, allowing for gentle adjustments when the deviation is small, and rapid increases in adjustment magnitude when the deviation is large. Furthermore, different adjustment strategies can be set through piecewise functions, such as maintaining the existing encryption complexity or throughput at low deviations, adjusting proportionally in the medium to high deviation range, and imposing fixed value limits or breakpoint protection when exceeding the limit. For adjusting encryption complexity, a dynamic parameter superposition mechanism can be introduced, such as adding additional encryption iterations or obfuscation layers to the existing complexity, thereby achieving more refined dynamic enhancement. Such a design not only improves the flexibility of adjustment but also better adapts to the security needs and performance requirements of different scenarios.

[0140] In this embodiment of the invention, obtaining the current encryption complexity of the sensitive encrypted file and multiplying it by a dynamic adjustment parameter for positive dynamic enhancement means that by increasing the strength of the encryption algorithm (e.g., upgrading from AES-128 to AES-256) or extending the length of the encryption key, sensitive data becomes more difficult to crack under potential threats. This adjustment method ensures that when access behavior is judged as abnormal, the protection layer of sensitive data is dynamically strengthened, effectively reducing the security risks caused by decryption attempts or data leakage. Obtaining the current decryption throughput rate of the target visitor and dividing it by the dynamic adjustment parameter for reverse dynamic limitation means that by reducing the speed of data decryption, the transmission rate of sensitive information is slowed down, thereby buying more time for the system's threat assessment and response. This limitation method avoids the misjudgment and business impact that may be caused by directly interrupting access, and adopts a gradual approach to dynamically limit the behavior of potential threat actors. The advantage of this adjustment method is that it realizes a flexible dynamic protection mechanism, which can effectively protect sensitive data without completely interrupting access. Compared to traditional access blocking or static encryption strategies, this dynamic adjustment mode is more intelligent and precise. It can adjust the strategy in real time according to the degree of abnormality of the visitor's behavior, which can both ensure data security and minimize the impact on normal users.

[0141] This technology has broad application prospects, especially in fields with extremely high data security requirements such as finance, healthcare, and government. For example, banking systems can dynamically increase the encryption level of transaction data when abnormal transfer requests are detected, while simultaneously limiting the data read rate of abnormal users, thereby reducing the potential risk of financial fraud. Furthermore, it can be applied to multi-tenant scenarios in cloud computing environments, dynamically protecting sensitive files and preventing malicious tenants from abusing resources.

[0142] In practice, suppose the system detects that a user's access frequency to an encrypted file suddenly and significantly exceeds its historical average, while the access concentration is biased towards sensitive fields of that file. After dynamically adjusting parameters and calculating, the system determines the severity of the access anomaly to be high. Therefore, the system increases the encryption complexity of the file from a medium-level encryption algorithm to a high-strength encryption algorithm. Simultaneously, the user's decryption rate is significantly reduced, allowing only a very small amount of data to be read per second. This adjustment not only effectively protects the security of sensitive data but also provides ample time for further analysis and response to the user's access behavior. In this way, the system achieves a good balance between protective flexibility and data security.

[0143] It should be understood that although the steps in the flowcharts of the various embodiments of the present invention are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the various embodiments may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least a portion of the sub-steps or stages of other steps.

[0144] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM), etc.

[0145] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0146] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

[0147] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

[0148] Examples are used only to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. An intrusion detection and protection method in a cloud computing environment, characterized in that: Includes the following steps: S1: After determining that a certain cloud database access behavior has abnormal characteristics, the target visitor of this access behavior is identified, the specific data object accessed is confirmed, the key byte pattern associated with the specific data object is extracted, and the historical access records of the target visitor are retrieved and loaded. S2: Parse the target visitor's historical access records and determine whether the target visitor's access frequency for the current key byte pattern and its similar patterns is greater than a preset threshold. If the target visitor's access frequency for the current key byte pattern and its similar patterns exceeds the preset threshold, mark the key byte pattern and its similar patterns as a specific byte pattern and proceed to S3; otherwise, return to S1. The key byte pattern and its similar patterns refer to a specific byte sequence related to a specific data object in the current access behavior, as well as other byte patterns that are similar to or related to the specific byte sequence. Similar patterns include byte sequences that partially match the key byte pattern in structure, patterns that are functionally or logically related but have been encoded or encrypted, and potential association patterns inferred from the target visitor's historical behavior. S3: Analyze and determine whether there are sensitive encrypted files in the cloud database that are directly associated with a specific byte pattern. If there are sensitive encrypted files that are directly associated with a specific byte pattern, combine the target visitor's historical access records and current access behavior to extract the core behavioral features of the historical access records and current access behavior, and proceed to S4; otherwise, return to S1. S4: Based on the extracted core behavioral features, dynamic adjustment parameters are generated comprehensively. Based on the dynamic adjustment parameters, the encryption complexity of sensitive encrypted files is dynamically enhanced in a positive direction, and the decryption throughput rate of the target visitor is dynamically limited in a reverse direction, so as to realize intrusion detection and protection in the cloud computing environment. The process of generating dynamic adjustment parameters based on extracted core behavioral features, and then dynamically enhancing the encryption complexity of sensitive encrypted files and dynamically limiting the decryption throughput rate of target visitors based on these parameters is as follows: The formula for calculating the adjustment parameters is called, and the extracted access frequency deviation features, target concentration deviation features, and specific byte pattern anomaly scores are substituted into the formula for weighted calculation to generate the final dynamic adjustment parameters. Obtain the current encryption complexity of the sensitive encrypted file, and multiply the encryption complexity by a dynamic adjustment parameter to perform positive dynamic enhancement. Obtain the current decryption throughput rate of the target visitor and divide the decryption throughput rate by the dynamic adjustment parameter to perform reverse dynamic limiting on it.

2. The intrusion detection and protection method in a cloud computing environment according to claim 1, characterized in that: The core behavioral features for extracting historical access records and current access behavior include: access frequency deviation features, target concentration deviation features, and specific byte pattern anomaly scores.

3. The intrusion detection and protection method in a cloud computing environment according to claim 1, characterized in that, The process of analyzing and determining whether there are sensitive encrypted files in the cloud database that are directly associated with a specific byte pattern, and if so, extracting the core behavioral characteristics of the target visitor by combining their historical access records and current access behavior, is as follows: Perform matching analysis on specific byte patterns to determine whether there are sensitive encrypted files in the cloud database that are directly associated with specific byte patterns; If a sensitive encrypted file directly associated with a specific byte pattern is identified, key access behavior indicators are extracted by combining the target visitor's historical access records and current access behavior. These indicators include the target visitor's current access frequency and historical average access frequency, current target data access concentration and historical average access target concentration, as well as the total number of bytes of requested data and the number of bytes corresponding to the key byte pattern in this abnormal access. Core behavioral features of historical access records and current access behavior are extracted using quantitative methods.

4. The intrusion detection and protection method in a cloud computing environment according to claim 3, characterized in that, The core behavioral features extracted from historical access records and current access behavior using quantitative methods include: Quantify the degree of deviation between the current access frequency and the historical average access frequency to derive access frequency deviation characteristics. Quantify the degree of deviation between the current concentration of target data access and the average concentration of historical target access to derive the target concentration deviation characteristics. Divide the number of bytes corresponding to the key byte pattern by the total number of bytes of the request data in this abnormal access to obtain the abnormality score of the specific byte pattern.

5. The intrusion detection and protection method in a cloud computing environment according to claim 1, characterized in that, The formula for calculating the adjustment parameter is: Where: D refers to the dynamic adjustment parameter, F current This refers to the current access frequency, F. avg This refers to the historical average access frequency. This refers to the access frequency deviation feature, where w1 is the weighting coefficient of the access frequency deviation feature, and T... current This refers to the current concentration of access to target data, T. avg This refers to the average concentration of historical visit targets. This refers to the target concentration deviation characteristic, w2 refers to the weighting coefficient of the target concentration deviation characteristic, and S specific w3 refers to the anomaly score for a specific byte pattern, and w3 refers to the weighting coefficient of the anomaly score for a specific byte pattern. In the formula for calculating the adjustment parameters B key This refers to the number of bytes corresponding to the key byte pattern, B total This refers to the total number of bytes of request data for this abnormal access.

6. An intrusion detection and prevention system in a cloud computing environment, characterized in that: include: Data acquisition module: After determining that a certain cloud database access behavior has abnormal characteristics, it is used to locate the target visitor of this access behavior, confirm the specific data object accessed, extract the key byte pattern associated with the specific data object, and retrieve and load the target visitor's historical access records. Specific Byte Pattern Determination Module: Used to determine the target visitor's historical access records and assess whether the target visitor's access frequency for the current keyword byte pattern and similar patterns exceeds a preset threshold. If the target visitor's access frequency for the current keyword byte pattern and similar patterns exceeds the threshold, the keyword byte pattern and similar patterns are marked as specific byte patterns, and the process is transferred to the core behavior feature extraction module; otherwise, the process is returned to the data acquisition module. The key byte pattern and its similar patterns refer to a specific byte sequence related to a specific data object in the current access behavior, as well as other byte patterns that are similar to or related to the specific byte sequence. Similar patterns include byte sequences that partially match the key byte pattern in structure, patterns that are functionally or logically related but have been encoded or encrypted, and potential association patterns inferred from the target visitor's historical behavior. Core Behavioral Feature Extraction Module: This module analyzes and determines whether there are sensitive encrypted files in the cloud database that are directly associated with a specific byte pattern. If such files exist, the module combines the target visitor's historical access records and current access behavior to extract their core behavioral features and transfers the module to the adjustment parameter generation and application module. Otherwise, it returns to the data acquisition module. The parameter generation and application module is used to generate dynamic adjustment parameters based on the extracted core behavioral features. Based on the dynamic adjustment parameters, the encryption complexity of sensitive encrypted files is dynamically enhanced in a positive direction, and the decryption throughput rate of the target visitor is dynamically limited in a negative direction, so as to realize intrusion detection and protection in the cloud computing environment. The process of generating dynamic adjustment parameters based on extracted core behavioral features, and then dynamically enhancing the encryption complexity of sensitive encrypted files and dynamically limiting the decryption throughput rate of target visitors based on these parameters is as follows: The formula for calculating the adjustment parameters is called, and the extracted access frequency deviation features, target concentration deviation features, and specific byte pattern anomaly scores are substituted into the formula for weighted calculation to generate the final dynamic adjustment parameters. Obtain the current encryption complexity of the sensitive encrypted file, and multiply the encryption complexity by a dynamic adjustment parameter to perform positive dynamic enhancement. Obtain the current decryption throughput rate of the target visitor and divide the decryption throughput rate by the dynamic adjustment parameter to perform reverse dynamic limiting on it.

7. The intrusion detection and prevention system in a cloud computing environment according to claim 6, characterized in that: The core behavioral feature extraction module specifically includes: The sensitive encrypted file inspection submodule is used to perform matching analysis on specific byte patterns to determine whether there are sensitive encrypted files in the cloud database that are directly associated with specific byte patterns; The behavior indicator extraction submodule is used to extract key access behavior indicators when there are sensitive encrypted files directly associated with a specific byte pattern, by combining the target visitor's historical access records and current access behavior. These indicators include the target visitor's current access frequency and historical average access frequency, current target data access concentration and historical average access target concentration, as well as the total number of bytes of requested data and the number of bytes corresponding to the key byte pattern in this abnormal access. The core behavioral feature quantification submodule is used to quantify the degree of deviation between the current access frequency and the historical average access frequency, and to obtain the access frequency deviation feature. It also quantifies the degree of deviation between the current target data access concentration and the historical average concentration of the target, and to obtain the target concentration deviation feature. Finally, it divides the number of bytes corresponding to the key byte pattern by the total number of bytes of the request data in this abnormal access to obtain the abnormality score of the specific byte pattern.

8. The intrusion detection and prevention system in a cloud computing environment according to claim 6, characterized in that, The adjustment parameter generation and application module specifically includes: The adjustment parameter calculation submodule is used to call the adjustment parameter calculation formula, substitute the extracted access frequency deviation features, target concentration deviation features, and specific byte pattern anomaly scores into the formula for weighted calculation, and generate the final dynamic adjustment parameters. The encryption complexity adjustment submodule is used to obtain the current encryption complexity of sensitive encrypted files and multiply the encryption complexity by a dynamic adjustment parameter to positively and dynamically enhance it. The decryption throughput rate adjustment submodule is used to obtain the current decryption throughput rate of the target visitor and divide the decryption throughput rate by the dynamic adjustment parameter to dynamically limit it in reverse.

Images