Intelligent control system and method for service security of business platform

Abstract

The invention discloses an intelligent control method for security of an in-service station service. The method comprises the following steps: acquiring calling data of the in-service station service; preprocessing the collected calling data to obtain time sequence data, global feature data and business dependency relationship data; constructing a multi-modal deep learning model and performing training, wherein the model comprises an LSTM module, a Transform module and a GNN module; and S3, inputting the time sequence feature, the high-dimensional feature vector and the node global feature obtained in the step 3 into a comprehensive decision-making layer to generate a final security decision, and realizing authorization, unauthorized blocking and tracing auditing of the service in the business. Through multi-model fusion and comprehensive decision, accurate authorization, real-time blocking of unauthorized behaviors and auditing tracing are realized, potential security risks are effectively identified and managed, and integrity and security of the system and data are ensured.

Description

Technical Field

[0001] The present invention relates to the field of computer science and technology, and in particular to a method for intelligently controlling the security of a business middle-end service. Background Art

[0002] With the rapid development of information technology, more and more companies are choosing to adopt a business middle-office architecture to improve business flexibility and scalability. However, the resulting security and stability issues of business middle-office services have become a key problem that companies urgently need to solve. Current security control methods mainly rely on traditional rule engines and static analysis technologies, but these methods have exposed many limitations when faced with complex and changing business needs and advanced attack methods. For example, traditional authorization strategies often have difficulty achieving accurate authorization, which can easily lead to abuse of authority or business interruption; existing audit mechanisms lack real-time performance, making it difficult to identify and block potential security risks in the first place. In addition, the performance and stability of traditional methods in high-concurrency environments also face severe tests.

[0003] In recent years, deep learning technology has achieved breakthroughs in fields such as computer vision and natural language processing. However, existing security control systems have yet to fully tap the potential of these deep learning models, failing to achieve precise authorization and intelligent decision-making for business middleware service calls. Therefore, there is an urgent need for an intelligent decision-making solution that integrates advanced deep learning technologies to enhance the security control capabilities of business middleware services, ensuring precise authorization, real-time auditing, and efficient blocking. Summary of the Invention

[0004] The purpose of the present invention is to provide a business middle-office service security intelligent control method, which combines the ability of the LSTM module to process time series data, the multi-head attention mechanism of the Transformer module, and the node relationship processing ability of the GNN module. Through multi-model fusion and comprehensive decision-making, it can achieve precise authorization, real-time blocking of unauthorized behavior and audit tracing, effectively identify and manage potential security risks, and ensure the integrity and security of the system and data.

[0005] In order to solve the above technical problems, the technical solution of the present invention is:

[0006] In a first aspect, the present invention provides a method for intelligently controlling service security in a business middle platform, characterized in that it includes the following steps:

[0007] Step 1: Collect call data of the business middle platform service, which includes user identity information, request parameters, call frequency, timestamp and context information;

[0008] Step 2: Preprocess the collected call data to obtain time series data, global feature data, and business dependency data;

[0009] Step 3: Build and train a multimodal deep learning model, which includes an LSTM module, a Transformer module, and a GNN module;

[0010] The LSTM module outputs time series features based on the time series data in step 2 to identify normal and abnormal call patterns;

[0011] The Transformer module, based on the temporal features and the global feature data obtained in step 2, outputs a high-dimensional feature vector through a multi-head self-attention mechanism and position encoding to identify abnormal call patterns;

[0012] The GNN module outputs node global features based on the high-dimensional feature vector and the business dependency data obtained in step 2 to identify potential security risks between services;

[0013] Step 4: Input the temporal features, high-dimensional feature vectors, and node global features obtained in step 3 into the comprehensive decision-making layer to generate the final security decision and implement authorization, unauthorized blocking, and retrospective auditing of business middle-office services.

[0014] Preferably, in step 2, the collected call data is preprocessed, and the specific steps are as follows:

[0015] Step 2.1: Clean the call data, including missing value processing, duplicate value processing and outlier detection;

[0016] Step 2.2: Use the Min-Max normalization method to process the call frequency and timestamps in the cleaned data. The normalization formula is as follows:

[0017]

[0018] Among them, X scaled represents the normalized value, X represents the original data, and X min and X max Represent the minimum and maximum values of the feature respectively;

[0019] Step 2.3: Perform feature extraction on the normalized data. Specifically, obtain time series data based on timestamps, obtain global feature data based on user information, request parameters, and context information, and obtain business dependency data based on call frequency and context information.

[0020] Preferably, in step 2.1, the interquartile range method is used to detect outliers, and the calculation formula is as follows:

[0021] IQR=Q3-Q1

[0022] Among them, IQR represents the interquartile range, Q1 represents the 25th percentile of the data, Q3 represents the 75th percentile of the data, and data less than Q1-1.5×IQR or greater than Q3+1.5×IQR will be considered outliers.

[0023] Preferably, in step 3, the LSTM module includes an input gate, a forget gate, and an output gate, and the structural expression is as follows:

[0024] f t =σ(W f ·[h t-1 ,x t ]+b f )

[0025] i t =σ(W i ·[h t-1 ,x t ]+b i )

[0026] o t =σ(W o ·[h t-1 ,x t ]+b o )

[0027]

[0028] h t =o t *tanh(C t )

[0029] Among them, f t Represents the output of the forget gate at time t, controlling the cell state C at time t-1 t-1 The retention ratio, i t Represents the output of the input gate at time t, controlling the state of the candidate cell at time t The update ratio, o t Represents the output of the output gate at time t, which controls the cell state C at time t t For the hidden state h t Contribution, Represents the candidate cell state at time t, stores temporary information, C t Represents the cell state at time t, which is updated by the forget gate and the input gate. t-1 represents the cell state at time t-1, h t Represents the hidden state at time t, which is passed to the next moment as output, W f Represents the weight matrix of the forget gate, W i Represents the weight matrix of the input gate, W o Represents the weight matrix of the output gate, WC The weight matrix representing the candidate cell state, h t-1 represents the hidden state at time t-1, x t represents the input vector at the current moment, b f represents the bias term of the forget gate, b i represents the bias term of the input gate, b o represents the bias term of the output gate, b C represents the bias term of the candidate cell state, σ represents the sigmoid function, which is responsible for controlling the switch of each gate, and tanh(·) represents the activation function, which limits the input and output to the range of [-1,1].

[0030] Preferably, in step 3, the Transformer module includes the following steps:

[0031] Step 3.1: Embed the temporal features and global feature data into input and convert them into feature vectors;

[0032] Step 3.2: Add the position information in the input sequence to the feature vector in step 3.1 through position encoding;

[0033] Step 3.3: Concatenate the input embedding from step 3.1 with the positional encoding from step 3.2 to obtain the embedding vector.

[0034] Step 3.4: Through the multi-head self-attention mechanism, multiple attention heads are used to process the embedding vector in parallel and output the attention-weighted feature vector. The calculation formula is as follows:

[0035]

[0036] Among them, Attention(·) represents the attention mechanism, softmax(·) represents the normalization function, which converts the attention weight into a probability distribution, Q represents the query vector, K represents the key vector, V represents the value vector, and d k represents the dimension of the key vector, and T represents transpose;

[0037] Step 3.5: Add the attention-weighted feature vector output in step 3.4 to the input embedding in step 3.1 and perform layer normalization, outputting the normalized feature vector.

[0038] Step 3.6: Pass the normalized feature vector output in step 3.5 to the feedforward neural network for nonlinear transformation, and output the feature vector after nonlinear transformation;

[0039] The feedforward neural network has the following structural expression:

[0040] FeedForward(x)=max(0,xW1+b1)W2+b2

[0041] Where FeedForward(·) represents the feedforward neural network layer, which is used for nonlinear feature transformation, max(·) represents the ReLU activation function, which introduces nonlinearity, x represents the input vector, W1 represents the dimension-increasing weight matrix, W2 represents the dimension-reducing weight matrix, b1 represents the bias term for the linear change of the hidden layer, and b2 represents the bias term for the linear transformation of the output layer.

[0042] Step 3.7: Add the nonlinearly transformed feature vector output in step 3.6 to the normalized feature vector output in step 3.5 and perform layer normalization to output the final normalized feature vector.

[0043] Step 3.8: The final normalized feature vector output in step 3.7 is linearly transformed to output a high-dimensional feature vector.

[0044] Preferably, in step 3, the GNN module includes a graph convolution layer, a global pooling layer, a fully connected layer, a Dropout layer and an output layer.

[0045] Preferably, in the graph convolution layer, the graph convolution represents the connection relationship between nodes through the adjacency matrix, and combines the node features to carry out information propagation. The formula is expressed as follows:

[0046]

[0047] in, represents the feature of node i in the l+1 layer, ReLU(·) represents the activation function, N(i) represents the set of neighbor nodes of node i, and W (l) represents the weight matrix of the lth layer, b (l) represents the bias term of the lth layer, represents the features of neighbor node j in layer l, c ij represents the normalized coefficient between node i and its neighbor node j.

[0048] Preferably, in step 4, the comprehensive decision layer generates a final security decision, which is specifically implemented as follows:

[0049] (1) The temporal features output by the LSTM module, the high-dimensional feature vector output by the Transformer module, and the node global features output by the GNN module are concatenated to obtain a fused feature vector;

[0050] (2) Perform nonlinear transformation on the fused feature vector and map it into a high-dimensional feature representation;

[0051] (3) Perform batch normalization and Dropout operations on the high-dimensional feature representation, adjust the normalization parameters and adjust the dropout rate;

[0052] (4) The regularized high-dimensional feature representation is mapped into a probability distribution through the Softmax function to generate the final security decision.

[0053] In the second aspect, a business middle platform service security intelligent control system is provided, which is characterized by including a data acquisition layer, a data processing layer, a model analysis layer and a comprehensive decision-making layer;

[0054] The data collection layer is used to collect the call data of the business middle platform services in real time and transmit the call data to the data processing layer;

[0055] The data processing layer is used to preprocess the call data collected in real time and transmit the preprocessed data to the model analysis layer;

[0056] Model analysis layer: used to analyze the preprocessed data and pass the output of the LSTM module, Transformer module and GNN module to the comprehensive decision layer;

[0057] Comprehensive decision-making layer: used to integrate and process the outputs of the LSTM module, Transformer module, and GNN module to generate the security assessment results of the current business middle-office service call, that is, the final security decision, and take corresponding actions to ensure the stable operation of the business middle-office service and data security.

[0058] Compared with the existing technology, the beneficial effects of the present invention are as follows: (1) The present invention integrates the time series data processing capability of the LSTM module, the multi-head attention mechanism of the Transformer module, and the node relationship processing capability of the GNN module, giving full play to the advantages of each module, and effectively realizing the multi-dimensional analysis and precise decision-making of the business middle-end service call. Through the comprehensive analysis of multiple modules, the system can dynamically adjust the authorization strategy to ensure the accuracy and flexibility of the decision-making; (2) The present invention analyzes the historical call data through the LSTM module and the Transformer module, accurately identifies the complex interaction pattern between the user and the system, and predicts the authorization requirements, effectively avoiding the abuse or insufficiency of authority, thereby reducing the security risk of the system. By real-time monitoring and analysis of service call behavior, combined with the GNN module, it intelligently identifies unauthorized access and abnormal behavior, quickly activates the blocking mechanism, and prevents unauthorized access. This significantly improves the security of the system, reduces potential threats, and ensures the continuous stability of the business middle-end service. The system also establishes an audit mechanism to record each service call and its decision-making process, support subsequent tracing and review, and improve the efficiency and accuracy of auditing. In terms of real-time performance and performance, by optimizing the model structure, the present invention ensures the good responsiveness of the system in a high-concurrency environment; (3) The present invention constructs a network structure integrating multiple modules and generates accurate security decisions for authorization, unauthorized blocking, and retroactive auditing through a comprehensive decision-making layer. The collaborative work of different modules significantly improves the robustness and anti-attack capabilities of the system. When faced with malicious attacks, the system can quickly identify and respond to them, avoiding system crashes or data leaks, ensuring the stable operation of intelligent decision-making technology in various attack scenarios, and guaranteeing the security and reliability of business middle-end services. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments of the present invention. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0060] Figure 1 This is a flow chart of the intelligent control method for service security in the business middle platform of the present invention;

[0061] Figure 2 This is a schematic diagram of the framework of the business middle-station service security intelligent control method of the present invention;

[0062] Figure 3 This is a schematic diagram of the framework of the business middle-station service security intelligent control system of the present invention. DETAILED DESCRIPTION

[0063] The following is a further detailed description of the present invention in conjunction with the accompanying drawings. The terminal technical solutions of the embodiments of the present invention are clearly and completely described. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0064] like Figure 1-2 As shown, the present invention provides a business middle-station service security intelligent control method, comprising the following steps:

[0065] Step 1: Collect call data of the business middle-end service, which includes user identity information, request parameters, call frequency, timestamp and context information.

[0066] User information includes user ID, login name, user role, user permissions, and business department. This information helps determine whether a user has permission to initiate a specific service request, thereby ensuring accurate permission control. Request parameters describe the specific content of each service call, including the API interface requested, the resource type involved (e.g., file, database record, service interface), and the operation type (e.g., read, write, modify, delete). These parameters help determine request compliance and ensure that the operation adheres to business rules. Call frequency records the number of requests initiated by a user within a specific time period. For example, the frequency of access to a resource by a single user within a certain time period. This data helps identify potential abuse or abnormal access patterns. For example, frequent access to the same resource may indicate the risk of an attack or improper operation. Timestamps record the time each service request occurs, capturing the temporal characteristics of the request. By analyzing timestamp data, we can identify whether there are periodic patterns or abnormal fluctuations in requests, thereby determining whether the requests conform to normal business operation patterns. For example, frequent access to a resource during non-business hours may indicate abnormal behavior. Contextual information includes the request source and request status. The request source includes the requesting IP address, device type, geographic location, etc.; the request status refers to the execution result of the request (success, failure, exception, etc.). This information plays an important role in subsequent anomaly detection and auditing, further ensuring the security of the system.

[0067] Step 2: Preprocess the collected call data to obtain time series data, global feature data, and business dependency data. The specific steps are as follows:

[0068] Step 2.1: Clean the call data, including missing value processing, duplicate value processing and outlier detection. The specific implementation is as follows:

[0069] (1) Missing value processing: Specifically, for missing values in call data, different processing strategies are adopted and corresponding processing is performed according to the data type. For missing user identity information, the record is deleted; for missing request parameters, the default value is used to fill in. For example, if the API interface is missing, the default API interface is filled in. For missing call frequency, the mean of its historical data is used to fill in. The filling formula is as follows:

[0070]

[0071] Among them, x j Indicates the fill value, Represents the mean of n non-missing data.

[0072] For missing timestamps, the record is deleted; for missing context information, it is filled with "unknown" to maintain data integrity.

[0073] (2) Duplicate value processing, specifically deleting duplicate data. This process checks the data for duplicate records, especially duplicate requests for user actions or service calls. It uses the "user ID" and "timestamp" to determine whether a record is a duplicate, and then deletes these duplicate items from the original data to obtain deduplicated data.

[0074] (3) Outlier detection, specifically using the interquartile range method to detect the call frequency, timestamp and request parameters and remove outliers or extreme values. For example, a sudden surge in call frequency or an abnormally high frequency of a certain operation type may indicate data errors or malicious behavior.

[0075] The interquartile range method is calculated as follows:

[0076] IQR=Q3-Q1

[0077] Among them, IQR represents the interquartile range, Q1 represents the 25th percentile of the data, Q3 represents the 75th percentile of the data, and data less than Q1-1.5×IQR or greater than Q3+1.5×IQR will be considered outliers.

[0078] Step 2.2: Use the Min-Max normalization method to process the call frequency and timestamps in the cleaned data. The normalization formula is as follows:

[0079]

[0080] Among them, X scaled represents the normalized value, X represents the original data, and X min and X max represent the minimum and maximum values of the feature respectively.

[0081] For the call frequency, first calculate the minimum and maximum values in the column of data, and then apply the above normalization formula to each data point to obtain the normalized call frequency value.

[0082] For timestamps, we first calculate the time interval between each request. Next, we calculate the minimum and maximum values in the timestamp data and use the normalization formula above to convert the timestamps to the range of [0, 1].

[0083] Step 2.3: Perform feature extraction on the normalized data. Specifically, obtain time series data based on timestamps, obtain global feature data based on user information, request parameters, and context information, and obtain business dependency data based on call frequency and context information.

[0084] The timestamp records the time each service request occurred. By calculating the time difference between the current request timestamp and the previous request timestamp, we obtain a time interval feature. This feature reflects the request interval pattern and helps identify request frequency and abnormal behavior (such as attacks or abuse). The LSTM module processes time series data, using the time interval feature as input for each time step. The LSTM module learns the patterns between timestamps and requests based on the dependencies in the time series data.

[0085] Feature extraction for user information, including user ID, login name, user role, user permissions, and business department, is handled differently depending on their nature. User IDs and login names are unique identifiers and lack direct numerical meaning. Therefore, label encoding is used to map them to unique integer values. User roles are discrete features with a finite set of categories (e.g., "Administrator" and "Ordinary User"). Different roles are mapped to numerical values, such as 0 for administrator and 1 for ordinary user. User permissions are also features with a finite set of categories (e.g., "Read," "Write," and "Delete"). Different permission types can be mapped to numerical values, with "Read" being 0, "Write" being 1, and "Delete" being 2. Business department features are similar to user roles, with different departments being mapped to numerical values (e.g., "Finance" being 0, "Technology" being 1, and "Sales" being 2). After label encoding, the user ID, role, permissions, and business department are generated into multiple numerical features, which are then concatenated into a comprehensive feature vector, which is then fed into the Transformer module as a global feature. These features help the model better understand user behavior patterns. For example, the model can use these features to determine whether a request meets the user's permission or role requirements.

[0086] Request parameters include the requested API interface, the resource type involved in the request, and the operation type. API interfaces typically represent different services or operational functions, and each interface may contain different request modes or access rules. Using one-hot encoding, different API interfaces are converted into binary vectors. For example, if there are three API interfaces (A, B, and C), they are represented by one-hot encoding as ([1, 0, 0], [0, 1, 0], and [0, 0, 1]), respectively. Resource types (such as database records, files, and services) represent the requested resource type and are also one-hot encoded, assigning a binary feature vector to each resource type. Operation types (such as read, write, modify, and delete) represent specific operations on the resource. Using one-hot encoding, each operation type is mapped to a binary vector. For example, read is ([1, 0, 0, 0]), write is ([0, 1, 0, 0]), delete is ([0, 0, 1, 0]), and modify is ([0, 0, 0, 1]). The features extracted independently for the API interface, resource type, and operation type are concatenated. Assume the API endpoint is [1,0,0], the resource type is [0,1,0], and the operation type is [1,0,0,0], and the concatenated feature vector is [1,0,0,0,1,0,1,0,0,0]. Multiple concatenated feature vectors are formed into a batch data matrix as the input to the Transformer module, with each row representing a request and each column representing a feature. The Transformer model treats these features as global information and processes them using a multi-head attention mechanism.

[0087] The call frequency is a numerical feature. Through statistical feature extraction, the statistics describing the data distribution are calculated, including the mean μ and variance σ. 2 , maximum value Max, minimum value Min and median M. These features are concatenated into a feature vector [μ,σ 2 ,Max,Min,M]. In the GNN module, the call frequency is used as the feature input of the graph node to analyze the correlation between nodes. By passing these call frequency features into the GNN model, the graph convolution operation is performed to identify the potential relationships between nodes and their abnormal patterns.

[0088] Feature extraction of contextual information includes processing the request source (IP address, device type, geographic location) and request status (success, failure, exception). Request source features include IP address, device type, and geographic location. Using region encoding, IP addresses are mapped to different geographic regions or networks, converting them into numerical features. Using IP-to-geolocation mapping, IP addresses are mapped to specific geographic regions (such as cities and countries), helping the model identify whether requests from different regions are anomalous. Device type (PC, mobile phone, tablet) is converted using one-hot encoding. Request status is typically a discrete feature representing the result of the request. Label encoding is used to convert the request status ("success" = 0, "failure" = 1, "abnormal" = 2) into a numerical feature. All features extracted from the request source and request status are concatenated to form a complete feature vector. The Transformer module excels at processing global features, so contextual information is input as a global feature into the Transformer encoder for processing. The model learns the relationships between different requests from a global perspective and performs pattern recognition. The GNN module also processes graph-structured data, using contextual information as feature input for graph nodes. Each request can be considered a node in the graph, and the node's features are the extracted contextual information. GNNs propagate information through graph convolution operations, identifying potentially anomalous request patterns. Contextual features are input as graph node features into the GNN model, which then learns the complex relationships between nodes through graph convolution and reveals anomalous behavior.

[0089] Step 3: Build and train a multimodal deep learning model, which includes an LSTM module, a Transformer module, and a GNN module.

[0090] Based on the time series data from step 2, the LSTM module outputs time series features and identifies normal and abnormal call patterns. This module can learn time series features from time series data, capturing the dynamic changes and patterns of requests. It can also analyze the time series features of service calls, identify the temporal order of call requests, and learn the temporal dependencies between call requests. It can also effectively identify patterns in request frequency, helping to distinguish between normal and abnormal requests. Abnormal requests typically manifest as abnormal time intervals and surges in call frequency. By capturing dependencies within the time series over a longer timeframe, the LSTM module can identify patterns in user behavior and peaks and troughs in requests.

[0091] like Figure 1 As shown in the figure, the LSTM module consists of three key parts: the input gate, the forget gate, and the output gate. The structural expression is as follows:

[0092] f t=σ(W f ·[h t-1 ,x t ]+b f )

[0093] i t =σ(W i ·[h t-1 ,x t ]+b i )

[0094] o t =σ(W o ·[h t-1 ,x t ]+b o )

[0095]

[0096] h t =o t *tanh(C t )

[0097] Among them, f t Represents the output of the forget gate at time t, controlling the cell state C at time t-1 t-1 The retention ratio, i t Represents the output of the input gate at time t, controlling the state of the candidate cell at time t The update ratio, o t Represents the output of the output gate at time t, which controls the cell state C at time t t For the hidden state h t Contribution, Represents the candidate cell state at time t, stores temporary information, C t Represents the cell state at time t, which is updated by the forget gate and the input gate. t-1 represents the cell state at time t-1, h t Represents the hidden state at time t, which is passed to the next moment as output, W f Represents the weight matrix of the forget gate, W i Represents the weight matrix of the input gate, W o Represents the weight matrix of the output gate, W C The weight matrix representing the candidate cell state, h t-1 represents the hidden state at time t-1, x t represents the input vector at the current moment, b f represents the bias term of the forget gate, b i represents the bias term of the input gate, b o represents the bias term of the output gate, b Crepresents the bias term of the candidate cell state, σ represents the sigmoid function, which is responsible for controlling the switch of each gate, and tanh(·) represents the activation function, which limits the input and output to the range of [-1,1].

[0098] The forget gate of the LSTM module determines the information to be forgotten based on the current input and the previous state. Through the output of the sigmoid function, the forget gate weights the unit state to control how much previous information is retained or forgotten. That is: f t =σ(W f ·[h t-1 ,x t ]+b f In the second step of the LSTM module operation, the output of the forget gate is multiplied by the previous cell state and combined with the output of the input gate to update the internal state of the LSTM module: The output gate is the last step in the LSTM module to determine which information to output to the next unit. The calculation of the output gate is also based on the sigmoid function, which multiplies its activation value with the unit state after tanh activation to obtain the output at the current moment: h t =o t *tanh(C t ).

[0099] The LSTM module processes the cell state C through the forget gate, input gate and output gate. t The LSTM module controls how much information to retain, forget, and output at each point in time. This allows the LSTM module to handle long-term dependencies, ensuring that important, long-term information is remembered while not overly focusing on short-term, irrelevant information. The LSTM module processes time series data using the aforementioned calculation formula, capturing temporal correlations and dynamic changes. The core of the LSTM module lies in its gating mechanism, which dynamically learns which information to retain and which to forget, enabling it to efficiently handle long-term dependencies.

[0100] like Figure 1 As shown in the figure, the Transformer module outputs a high-dimensional feature vector based on the temporal features and the global feature data obtained in step 2 through a multi-head self-attention mechanism and position encoding to identify abnormal call patterns, including the following steps:

[0101] Step 3.1: Embed the temporal features and global feature data into input and convert them into feature vectors;

[0102] Step 3.2: Add the position information in the input sequence to the feature vector in step 3.1 through position encoding;

[0103] Step 3.3: Concatenate the input embedding from step 3.1 with the positional encoding from step 3.2 to obtain the embedding vector.

[0104] Step 3.4: Through the multi-head self-attention mechanism, multiple attention heads are used to process the embedding vector in parallel and output the attention-weighted feature vector. The calculation formula is as follows:

[0105]

[0106] Among them, Attention(·) represents the attention mechanism, softmax(·) represents the normalization function, which converts the attention weight into a probability distribution, Q represents the query vector, K represents the key vector, V represents the value vector, and d k represents the dimension of the key vector, and T represents transpose;

[0107] Step 3.5: Add the attention-weighted feature vector output in step 3.4 to the input embedding in step 3.1 and perform layer normalization, outputting the normalized feature vector.

[0108] Step 3.6: Pass the normalized feature vector output in step 3.5 to the feedforward neural network for nonlinear transformation, and output the feature vector after nonlinear transformation;

[0109] The feedforward neural network has the following structural expression:

[0110] FeedForward(x)=max(0,xW1+b1)W2+b2

[0111] Where FeedForward(·) represents the feedforward neural network layer, which is used for nonlinear feature transformation, max(·) represents the ReLU activation function, which introduces nonlinearity, x represents the input vector, W1 represents the dimension-increasing weight matrix, W2 represents the dimension-reducing weight matrix, b1 represents the bias term for the linear change of the hidden layer, and b2 represents the bias term for the linear transformation of the output layer.

[0112] Step 3.7: Add the nonlinearly transformed feature vector output in step 3.6 to the normalized feature vector output in step 3.5 and perform layer normalization to output the final normalized feature vector.

[0113] Step 3.8: The final normalized feature vector output in step 3.7 is linearly transformed to output a high-dimensional feature vector.

[0114] Based on the temporal features output by the LSTM module, the Transformer module can capture the temporal dependencies between requests and analyze their dynamic trends. Based on global feature data, the Transformer module can comprehensively determine the legitimacy of requests and analyze user roles, permissions, and requested operations. Leveraging a multi-head self-attention mechanism, the Transformer module can capture relationships between features in different feature spaces in parallel. This enables the model to accurately identify interactions between different dimensions and generate feature representations that aid in security decision-making. The output of the Transformer module is a feature representation of the processed input data, encompassing the relationship between temporal features and global features. In this scenario, the output includes high-dimensional feature representations related to request legitimacy, unauthorized behavior, and abnormal patterns.

[0115] The GNN module outputs node global features based on the high-dimensional feature vector and the business dependency data obtained in step 2 to identify potential security risks between services.

[0116] The core function of the GNN module is to analyze graph-structured data through graph convolution operations. By processing the features of nodes and edges in the graph, graph neural networks can deeply understand the complex relationships between nodes (such as services and users) in the graph structure. Through graph convolution operations, the GNN module can model the relationships between nodes in the graph, propagate information, and capture the mutual influence between nodes. Between different layers of the GNN module, the input features, including the high-dimensional feature vectors output by the Transformer module and business dependency data, can be fused to further enhance node features. The node features in the graph structure are aggregated to generate a graph-level representation, helping the model capture global patterns.

[0117] like Figure 1 As shown in Figure 1, the GNN module includes a graph convolution layer, a global pooling layer, a fully connected layer, a dropout layer, and an output layer. In the graph convolution layer, the graph convolution represents the connection relationship between nodes through the adjacency matrix and combines the node features for information propagation. The formula is as follows:

[0118]

[0119] in, represents the feature of node i in the l+1 layer, ReLU(·) represents the activation function, N(i) represents the set of neighbor nodes of node i, and W (l) represents the weight matrix of the lth layer, b (l) represents the bias term of the lth layer, represents the features of neighbor node j in layer l, c ij represents the normalized coefficient between node i and its neighbor node j.

[0120] After each layer of graph convolution, features from different sources are fused (such as Transformer output and call frequency) to further enhance the expressiveness of the model. After the graph convolution layer, the global pooling layer converts node features into graph-level feature representations, which helps to integrate local node information into global information and capture cross-node dependencies and potential patterns. The node features after graph convolution and pooling are passed to the fully connected layer for feature integration. Through the fully connected layer, the model can use the extracted features to determine the legitimacy of the request and identify potential security risks. In order to prevent overfitting, the Dropout layer randomly discards the features of some nodes, so that the model has better generalization ability and improves its adaptability to unseen data.

[0121] The input to the GNN module includes the output of the Transformer module, which is represented by high-dimensional features obtained through the Transformer module. These features integrate information such as temporal features and global features to determine the legitimacy of requests; call frequency, as a numerical feature, can help the model capture the frequency of requests and identify abnormal request behavior; contextual information, including user information, request source, request status, etc., as graph node features, helps the model understand the background information and potential risks of requests. In the GNN module, these input features will be processed as graph node features, and the relationships between nodes are modeled through the graph structure (such as the call relationship between services). The output of the GNN module includes node features processed by graph convolution operations. These features can reveal potential relationships and abnormal patterns between nodes. After graph convolution, the GNN module will perform global pooling to integrate node-level features into node-global features, which helps capture cross-service dependencies and potential risk patterns.

[0122] Step 4: Input the time series features, high-dimensional feature vectors, and node global features obtained in step 3 into the comprehensive decision-making layer to generate the final security decision, implement authorization, unauthorized blocking, and retrospective audit of business middle-end services, and implement the following specific implementation:

[0123] (1) The temporal features output by the LSTM module, the high-dimensional feature vector output by the Transformer module, and the node global features output by the GNN module are concatenated to obtain a fused feature vector;

[0124] (2) Perform nonlinear transformation on the fused feature vector and map it into a high-dimensional feature representation;

[0125] (3) Perform batch normalization and Dropout operations on the high-dimensional feature representation, adjust the normalization parameters and adjust the dropout rate;

[0126] (4) The regularized high-dimensional feature representation is mapped into a probability distribution through the Softmax function to generate the final security decision.

[0127] like Figure 1 As shown, the comprehensive decision layer includes a feature fusion layer, an activation layer, multiple fully connected layers, a batch normalization layer, a dropout layer, and a softmax layer. Feature fusion is first performed, concatenating the output features of the LSTM module, the Transformer module, and the GNN module to form a fused feature vector that contains all the information. The fused feature vector is then activated with ReLU, helping the model capture nonlinear features. A fully connected layer then maps low-dimensional features to higher-dimensional representations, learning complex relationships between features. Batch normalization standardizes the output of each layer before it is applied, reducing internal covariate shift, accelerating training, and improving model stability. The dropout layer prevents overfitting by randomly dropping a portion of neurons, forcing the model to learn more robust features. Finally, the softmax layer maps the security decision into a probability distribution, representing the final security decision. The softmax layer calculates the probability of each category, ensuring that the sum of all outputs is 1, and outputs the probabilities of different decisions. The softmax layer outputs probabilities for three decision categories: the probability of accurately granting permission, the probability of identifying and blocking unauthorized requests, and the probability of recording and tracking abnormal behavior. The comprehensive decision-making layer combines the outputs of multiple modules to provide accurate security decisions and ensure that the system can cope with complex security issues.

[0128] like Figure 3 As shown, the present invention also provides a business middle-end service security intelligent control system, including a data acquisition layer, a data processing layer, a model analysis layer and a comprehensive decision-making layer.

[0129] The data collection layer is used to collect call data from business middleware services in real time and transmit this call data to the data processing layer. Call data includes, but is not limited to, user request information, call frequency, request parameters, timestamps, and context information. Through the real-time data collection layer, the system can obtain call data in real time at every stage, ensuring the timeliness and accuracy of the data source. The system can continuously capture node data such as user requests and call frequency through the real-time data collection layer and efficiently transmit this data to the back-end data processing layer. This layer uses a real-time stream processing architecture to ensure low latency and high throughput for data transmission, supporting subsequent data analysis and security assessments.

[0130] The data processing layer is used to preprocess the call data collected in real time and transmit the preprocessed data to the model analysis layer. The real-time processing of call data involves first cleaning the collected call data to remove redundant information, noise data, and outliers to ensure data quality and eliminate misjudgments due to data errors. The cleaned data is then normalized and feature extracted to extract key time series features and other factors that affect security decisions. The feature extraction process converts the raw data into a format suitable for subsequent module processing, ensuring that the data is compatible with the input requirements of different modules. This includes converting the data into vectors, matrices, or graph structures to meet the processing needs of different models.

[0131] Model Analysis Layer: This layer analyzes preprocessed data and passes the outputs of the LSTM module, Transformer module, and GNN module to the comprehensive decision-making layer. The LSTM module processes time series data, captures dynamic changes in time series data, analyzes historical call patterns, and predicts possible abnormal behaviors. It can effectively identify potential long-term dependencies and has good adaptability during peak business traffic periods. The Transformer module uses its multi-head attention mechanism to comprehensively analyze the relationships between different requests, especially in complex contexts and multiple interaction scenarios. It can capture long-distance dependencies and identify complex patterns related to abnormal behaviors. The GNN module analyzes the call relationship graph of business middle-end services, focusing on the complex call patterns between services. The GNN module processes graph-structured data (such as users, services, and call relationships) and can identify potential security risks between services, especially those related to unauthorized operations and abuse of authority.

[0132] Comprehensive decision-making layer: used to integrate and process the outputs of the LSTM module, Transformer module, and GNN module to generate the security assessment results of the current business middle-office service call, that is, the final security decision, and take corresponding actions to ensure the stable operation of the business middle-office service and data security.

[0133] The security decision-making process is specifically implemented as follows:

[0134] (1) Based on the security assessment results, determine whether the user has sufficient permissions to access a specific service. If there is abuse of permissions or unauthorized behavior, the system will immediately reject the request at the application layer and log it.

[0135] (2) When a possible unauthorized request is detected, the application layer will immediately implement blocking measures, stop further processing of the request, and send an alert to the system administrator in a timely manner.

[0136] (3) For possible security incidents, the system will generate detailed audit logs and trace abnormal behaviors to facilitate subsequent security reviews and risk assessments.

[0137] The above security decision-making process uses a rapid response mechanism to ensure that the system can make decisions and take actions quickly in a real-time changing network environment, thereby minimizing potential security risks.

[0138] The system implements an efficient, real-time monitoring and anomaly detection mechanism. Real-time data collection and processing provide precise input for the system. The combined use of the LSTM module's capabilities in time series data processing, the Transformer module's multi-head attention mechanism, and the GNN module's ability to process inter-node relationships ensures the system's ability to conduct security assessments from multiple dimensions. Based on this, the integrated decision-making layer can make rapid decisions based on real-time security assessment results, implementing security measures such as precise authorization, unauthorized blocking, and retrospective auditing to effectively prevent security threats and ensure the stable operation and data security of the business middleware services.

[0139] The parts not involved in the present invention are the same as the existing technology or are implemented by using the existing technology.

[0140] The above is a further detailed description of the present invention in conjunction with specific embodiments, and the specific implementation of the present invention cannot be considered to be limited to these descriptions. For those skilled in the art of the present invention, several simple deductions or substitutions can be made without departing from the concept of the present invention, and all of these should be considered to fall within the scope of protection of the present invention.

Claims

1. A business middle platform service security intelligent control method, characterized in that: The steps include: Step 1: Collect call data of the business middle platform service, which includes user identity information, request parameters, call frequency, timestamp and context information; Step 2: Preprocess the collected call data to obtain time series data, global feature data, and business dependency data; Step 3: Build and train a multimodal deep learning model, which includes an LSTM module, a Transformer module, and a GNN module; The LSTM module outputs time series features based on the time series data in step 2 to identify normal and abnormal call patterns; the Transformer module outputs high-dimensional feature vectors based on the time series features and the global feature data obtained in step 2 through a multi-head self-attention mechanism and position encoding to identify abnormal call patterns; The GNN module outputs node global features based on the high-dimensional feature vector and the business dependency data obtained in step 2 to identify potential security risks between services; Step 4: Input the temporal features, high-dimensional feature vectors, and node global features obtained in step 3 into the comprehensive decision-making layer to generate the final security decision and implement authorization, unauthorized blocking, and retrospective auditing of business middle-office services.

2. A method for intelligent control of service security in a business middle platform according to claim 1, characterized in that: In step 2, the collected call data is preprocessed. The specific steps are as follows: Step 2.1: Clean the call data, including missing value processing, duplicate value processing and outlier detection; Step 2.2: Use the Min-Max normalization method to process the call frequency and timestamps in the cleaned data. The normalization formula is as follows: Among them, X scaled represents the normalized value, X represents the original data, and X min and X max Represent the minimum and maximum values of the feature respectively; Step 2.3: Perform feature extraction on the normalized data. Specifically, obtain time series data based on timestamps, obtain global feature data based on user information, request parameters, and context information, and obtain business dependency data based on call frequency and context information.

3. A method for intelligent control of service security in a business middle platform according to claim 2, characterized in that: In step 2.1, the interquartile range method is used to detect outliers. The calculation formula is as follows: IQR=Q3-Q1 Among them, IQR represents the interquartile range, Q1 represents the 25th percentile of the data, Q3 represents the 75th percentile of the data, and data less than Q1-1.5×IQR or greater than Q3+1.5×IQR will be considered outliers.

4. A method for intelligent control of service security in a business middle platform according to claim 1, characterized in that: In step 3, the LSTM module includes an input gate, a forget gate, and an output gate, and its structure expression is as follows: f t =σ(W f ·[h t-1 ,x t ]+b f ) i t =σ(W i ·[h t-1 ,x t ]+b i ) the t =σ(W o ·[h t-1 ,x t ]+b o ) h t =o t *tanh(C t ) Among them, f t Represents the output of the forget gate at time t, controlling the cell state C at time t-1 t-1 The retention ratio, i t Represents the output of the input gate at time t, controlling the state of the candidate cell at time t The update ratio, o t Represents the output of the output gate at time t, which controls the cell state C at time t t For the hidden state h t Contribution, Represents the candidate cell state at time t, stores temporary information, C t Represents the cell state at time t, which is updated by the forget gate and the input gate. t-1 represents the cell state at time t-1, h t Represents the hidden state at time t, which is passed to the next moment as output, W f Represents the weight matrix of the forget gate, W i Represents the weight matrix of the input gate, W o Represents the weight matrix of the output gate, W C The weight matrix representing the candidate cell state, h t-1 represents the hidden state at time t-1, x t represents the input vector at the current moment, b f represents the bias term of the forget gate, b i represents the bias term of the input gate, b o represents the bias term of the output gate, b C represents the bias term of the candidate cell state, σ represents the sigmoid function, which is responsible for controlling the switch of each gate, and tanh(·) represents the activation function, which limits the input and output to the range of [-1,1].

5. A method for intelligent control of service security in a business middle platform according to claim 1, characterized in that: In step 3, the Transformer module includes the following steps: Step 3.1: Embed the temporal features and global feature data into input and convert them into feature vectors; Step 3.2: Add the position information in the input sequence to the feature vector in step 3.1 through position encoding; Step 3.3: Concatenate the input embedding from step 3.1 with the positional encoding from step 3.2 to obtain the embedding vector. Step 3.4: Through the multi-head self-attention mechanism, multiple attention heads are used to process the embedding vector in parallel and output the attention-weighted feature vector. The calculation formula is as follows: Among them, Attention(·) represents the attention mechanism, softmax(·) represents the normalization function, which converts the attention weight into a probability distribution, Q represents the query vector, K represents the key vector, V represents the value vector, and d k represents the dimension of the key vector, and T represents transpose; Step 3.5: Add the attention-weighted feature vector output in step 3.4 to the input embedding in step 3.1 and perform layer normalization, outputting the normalized feature vector. Step 3.6: Pass the normalized feature vector output in step 3.5 to the feedforward neural network for nonlinear transformation, and output the feature vector after nonlinear transformation; The feedforward neural network has the following structural expression: FeedForward(x)=max(0,xW1+b1)W2+b2 Where FeedForward(·) represents the feedforward neural network layer, which is used for nonlinear feature transformation, max(·) represents the ReLU activation function, which introduces nonlinearity, x represents the input vector, W1 represents the dimension-increasing weight matrix, W2 represents the dimension-reducing weight matrix, b1 represents the bias term for the linear change of the hidden layer, and b2 represents the bias term for the linear transformation of the output layer. Step 3.7: Add the nonlinearly transformed feature vector output in step 3.6 to the normalized feature vector output in step 3.5 and perform layer normalization to output the final normalized feature vector. Step 3.8: The final normalized feature vector output in step 3.7 is linearly transformed to output a high-dimensional feature vector.

6. A method for intelligent control of service security in a business middle platform according to claim 1, characterized in that: In step 3, the GNN module includes a graph convolution layer, a global pooling layer, a fully connected layer, a Dropout layer, and an output layer.

7. A method for intelligent control of service security in a business middle platform according to claim 6, characterized in that: In the graph convolution layer, the graph convolution uses the adjacency matrix to represent the connection relationship between nodes and combines node features for information propagation. The formula is as follows: in, represents the feature of node i in the l+1 layer, ReLU(·) represents the activation function, N(i) represents the set of neighbor nodes of node i, and W (l) represents the weight matrix of the lth layer, b (l) represents the bias term of the lth layer, represents the features of neighbor node j in layer l, c ij represents the normalized coefficient between node i and its neighbor node j.

8. A method for intelligent control of service security in a business middle platform according to claim 1, characterized in that: In step 4, the comprehensive decision layer generates the final security decision, which is specifically implemented as follows: (1) The temporal features output by the LSTM module, the high-dimensional feature vector output by the Transformer module, and the node global features output by the GNN module are concatenated to obtain a fused feature vector; (2) Perform nonlinear transformation on the fused feature vector and map it into a high-dimensional feature representation; (3) Perform batch normalization and Dropout operations on the high-dimensional feature representation, adjust the normalization parameters and adjust the dropout rate; (4) The regularized high-dimensional feature representation is mapped into a probability distribution through the Softmax function to generate the final security decision.

9. A business middle platform service security intelligent control system, characterized in that: It includes data collection layer, data processing layer, model analysis layer and comprehensive decision-making layer; The data collection layer is used to collect the call data of the business middle platform services in real time and transmit the call data to the data processing layer; The data processing layer is used to preprocess the call data collected in real time and transmit the preprocessed data to the model analysis layer; Model analysis layer: used to analyze the preprocessed data and pass the output of the LSTM module, Transformer module and GNN module to the comprehensive decision layer; Comprehensive decision-making layer: used to integrate and process the outputs of the LSTM module, Transformer module, and GNN module to generate the security assessment results of the current business middle-office service call, that is, the final security decision, and take corresponding actions to ensure the stable operation of the business middle-office service and data security.

Images