A cloud computing-based e-commerce platform network security monitoring method and system

Abstract

The present invention relates to the technical field of network security of e-commerce platforms, and discloses a network security monitoring method and system for e-commerce platforms based on cloud computing. The method is to update the API gateway processing logic based on the event trigger mechanism adjustment strategy obtained from the serverless function operation log data and API gateway call record data, optimize the function parameters based on the high-load period response delay time series data obtained by the request call frequency analysis of the key interface request peak time series data, analyze the abnormal requests of the security detection engine event processing log after parameter optimization to obtain the abnormal detection coverage, and when it reaches the preset coverage requirement, obtain the abnormal traffic data for cluster analysis to obtain the abnormal event classification result. The present invention can effectively perceive the black box characteristics and multi-stage collaborative call characteristics of serverless functions, effectively improve the comprehensiveness and accuracy of security risk monitoring, and ensure the continuous and stable operation of the platform under high-load scenarios.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security monitoring method and system for an e-commerce platform based on cloud computing. Background Art

[0002] With the rapid development of cloud computing technology, serverless computing, as an emerging computing paradigm, has been widely adopted by e-commerce platforms. Its ability to allocate resources on demand and elastically scale greatly improves the system's efficiency in responding to traffic surges, effectively ensuring platform performance during promotional events. By breaking down computing tasks into short-lived functional units and leveraging dynamic scheduling on cloud platforms, this technology not only reduces development and maintenance costs but also enables real-time responses to user requests. However, serverless computing environments in e-commerce scenarios involve a large amount of sensitive user data, making it vulnerable to malicious attacks. The real-time nature of security detection and the level of automated protection directly impact system reliability and user trust. Therefore, effectively ensuring network security in serverless computing environments has become a significant research area.

[0003] Existing traditional network security detection methods mainly rely on static rules or predefined models. Although they perform well in fixed environments, they cannot effectively adapt to the short lifecycle and diverse triggering mechanisms of serverless functions in the dynamic and distributed architecture of serverless computing. It is difficult to monitor the internal behavior of functions, resulting in an inability to detect threats such as malicious code injection and data theft. At the same time, traditional detection methods require a lot of manual intervention and are unable to keep up with the ever-changing traffic patterns and potential threats, resulting in detection lags or high false alarm rates. Especially in the high-pressure scenarios of e-commerce platform promotions, the security and real-time guarantees for the coordinated processing of multiple function calls are obviously insufficient, which in turn threatens the stability of the entire e-commerce platform. Therefore, there is an urgent need to provide a real-time intelligent detection and protection method for the network security of cloud computing e-commerce platforms that can effectively cope with the black-box characteristics of serverless functions, such as the short lifecycle, dynamic and diverse triggering, and multi-stage collaboration. Summary of the Invention

[0004] The purpose of the present invention is to provide a network security monitoring method for an e-commerce platform based on cloud computing. By adopting a function real-time parameter optimization and adjustment mechanism that dynamically analyzes the call event triggering mechanism based on serverless function operation logs and API gateway call records, combined with the innovative design of the abnormal request analysis mechanism based on the security detection engine event processing log, it can effectively perceive the black box characteristics and multi-stage collaborative call characteristics of serverless functions, improve the efficiency, comprehensiveness and accuracy of security threat risk detection, and provide reliable technical support for real-time intelligent security detection of e-commerce platforms under high concurrent load scenarios, thereby ensuring the continuous safe and stable operation of e-commerce platforms under high load scenarios.

[0005] In order to achieve the above objectives, a cloud computing-based e-commerce platform network security monitoring method and system are provided.

[0006] In a first aspect, an embodiment of the present invention provides a method for monitoring network security of an e-commerce platform based on cloud computing, the method comprising the following steps:

[0007] Obtaining the running log data and API gateway call record data of the serverless function on the e-commerce platform, and performing event trigger mechanism analysis based on the running log data and the API gateway call record data to obtain the corresponding event trigger mechanism adjustment strategy;

[0008] Update and adjust the API gateway processing logic according to the event trigger mechanism adjustment strategy, and obtain the peak timing data of key interface requests after the processing logic is updated;

[0009] Performing request call frequency analysis based on the critical interface request peak timing data to obtain response delay timing data during a high-load period, and optimizing and adjusting the real-time parameters of the serverless function based on the response delay timing data during the high-load period;

[0010] Obtaining an event processing log of the security detection engine after real-time parameter optimization, and performing abnormal request analysis based on the event processing log to obtain abnormal detection coverage;

[0011] When the anomaly detection coverage reaches a preset coverage requirement, abnormal traffic data corresponding to the abnormal event is obtained, and cluster analysis is performed on the abnormal traffic data to obtain an abnormal event classification result.

[0012] Furthermore, the step of analyzing the event trigger mechanism based on the operation log data and the API gateway call record data to obtain the corresponding event trigger mechanism adjustment strategy includes:

[0013] According to the running log data, obtaining the corresponding function call time series;

[0014] According to the triggering time corresponding to the duration of each function call in the function call time series, the API gateway call record data is traversed to obtain the corresponding function call record, and the function call record data set is generated based on all the function call records; the function call record includes the call time, call result and response time;

[0015] An event triggering mechanism analysis is performed based on the function call record data set to obtain a corresponding event triggering mechanism adjustment strategy.

[0016] Furthermore, the step of obtaining a corresponding function call time series according to the operation log data includes:

[0017] Obtaining an operation information set of the serverless function according to the operation log data; the operation information set includes multiple operation records; the operation records include a triggering time, an execution status, and an operation end time;

[0018] Obtain the function call duration of the corresponding operation record based on the difference between the operation end time and the triggering time of each operation record in the operation information set, and mark the function call duration with the corresponding triggering time to generate a function call duration dataset;

[0019] Sort the function call durations in the function call duration data set according to the corresponding triggering times to generate a corresponding initial call duration time series;

[0020] Based on a preset sliding window, the long time series during the initial call is smoothed to obtain the long time series during the function call.

[0021] Furthermore, the step of analyzing the event trigger mechanism according to the function call record data set and obtaining the corresponding event trigger mechanism adjustment strategy includes:

[0022] Obtaining a corresponding function call response delay sequence according to the difference between the response time and the call time of each function call record in the function call record data set;

[0023] Obtaining a corresponding function call time interval sequence according to a difference between call times of two adjacent function call records in the function call record data set;

[0024] Obtaining a corresponding function call frequency according to the function call response delay sequence and the function call time interval sequence, and obtaining a target sliding window size according to the function call frequency;

[0025] Smoothing the function call time interval sequence according to the target sliding window size to obtain a corresponding call event triggering interval time sequence;

[0026] A trend analysis is performed on the call event trigger interval time series based on an autoregressive model, and the event trigger mechanism adjustment strategy is generated according to the corresponding trend analysis result.

[0027] Furthermore, the key interface request peak timing data includes product detail page request peak timing data and order submission interface request peak timing data; and the step of performing request call frequency analysis based on the key interface request peak timing data to obtain high-load period response delay timing data includes:

[0028] According to the peak timing series data of various key interface requests, the corresponding high-load period request function call records are obtained, and according to the high-load period request function call records, the corresponding high-load period request function call frequency timing series data is obtained;

[0029] Compare the peak time series data of various key interface requests with the data at different moments in the corresponding high-load period request function call frequency time series data in sequence, and generate the corresponding high-load period event trigger interval time series data based on the difference between the sequence moment when the request function call frequency is greater than the peak time of the key interface request and the previous moment;

[0030] According to the high-load period event trigger interval timing data, the corresponding security detection engine response duration timing data is obtained, and according to the difference between the high-load period event trigger interval timing data and the security detection engine response duration timing data, the high-load period response delay timing data corresponding to the peak timing data of various key interface requests is generated;

[0031] The high-load period response delay timing data is obtained according to the average timing data of the high-load period response delay timing data corresponding to the peak timing data of each type of key interface request.

[0032] Furthermore, the step of optimizing and adjusting the real-time parameters of the serverless function according to the high-load period response delay time series data includes:

[0033] Obtaining an average response delay based on the response delay time series data during the high-load period;

[0034] Determine whether the average response delay is greater than an expected delayed response threshold, and if so, obtain the corresponding actual response delay deviation;

[0035] Generating a real-time parameter adjustment strategy for the serverless function according to a deviation range corresponding to the actual response delay deviation;

[0036] According to the real-time parameter adjustment strategy of the serverless function, the real-time parameters are optimized and adjusted.

[0037] Furthermore, the step of analyzing abnormal requests according to the event processing log to obtain abnormal detection coverage includes:

[0038] Based on the preset log extraction technology, the abnormal request data is extracted from the event processing log to generate a corresponding abnormal request data set; the abnormal request data includes the request type, request timestamp and corresponding inspection result;

[0039] Performing statistical analysis on the abnormal request data set to obtain corresponding abnormal triggering frequencies;

[0040] Based on the abnormal trigger frequency, determine whether the real-time parameter adjustment is effective. If so, obtain the abnormal request event count of the security detection engine in the corresponding time period, and match and analyze the abnormal request event count and the log abnormal request record in the corresponding time period to obtain the abnormal detection coverage.

[0041] Furthermore, the abnormal traffic data includes the IP address, request time, and request frequency of each abnormal data flow; and the step of performing cluster analysis on the abnormal traffic data to obtain abnormal event classification results includes:

[0042] Based on the request time, cluster analysis is performed on the abnormal traffic data to obtain multiple clusters;

[0043] Based on the preset classification algorithm, the abnormal traffic data of each cluster is classified and predicted to obtain multiple abnormal event groups;

[0044] Based on the preset neural network model, abnormal features are extracted from the abnormal traffic data of each abnormal event group to obtain the corresponding abnormal event features;

[0045] Match and analyze the abnormal event features and clusters corresponding to each abnormal event group with the preset abnormal pattern knowledge base to obtain the corresponding abnormal event pattern;

[0046] According to the abnormal source category corresponding to the abnormal event pattern, the abnormal event classification corresponding to the abnormal traffic is obtained; the abnormal event classification includes gang attacks and order-brushing behaviors;

[0047] According to the abnormal event classification of all abnormal traffic, the abnormal event classification result is obtained.

[0048] Furthermore, the method further comprises:

[0049] Obtain the detection function running status time series data corresponding to different abnormal event classifications in the abnormal event classification results, and perform performance resource fluctuation correlation analysis based on the detection function running status time series data, and update the abnormal event detection rules based on the corresponding correlation analysis results; the detection function running status time series data includes the function single execution time, function call frequency and function call error rate.

[0050] In a second aspect, an embodiment of the present invention provides an e-commerce platform network security monitoring system based on cloud computing, the system comprising:

[0051] A trigger mechanism analysis module is used to obtain the operation log data and API gateway call record data of the serverless function on the e-commerce platform, and perform event trigger mechanism analysis based on the operation log data and the API gateway call record data to obtain the corresponding event trigger mechanism adjustment strategy;

[0052] A trigger mechanism update module is used to update and adjust the API gateway processing logic according to the event trigger mechanism adjustment strategy, and obtain the key interface request peak time series data after the processing logic is updated;

[0053] a function parameter optimization module, configured to analyze the request call frequency based on the peak timing data of the key interface requests, obtain the response delay timing data during the high-load period, and optimize and adjust the real-time parameters of the serverless function based on the response delay timing data during the high-load period;

[0054] A detection coverage analysis module is used to obtain the event processing log of the security detection engine after real-time parameter optimization, and perform abnormal request analysis based on the event processing log to obtain abnormal detection coverage;

[0055] The abnormal event classification module is used to obtain abnormal traffic data corresponding to the abnormal event when the abnormal detection coverage reaches the preset coverage requirement, and perform cluster analysis on the abnormal traffic data to obtain abnormal event classification results.

[0056] The present invention provides a network security monitoring method and system for an e-commerce platform based on cloud computing. The method realizes obtaining the operation log data of the serverless function on the e-commerce platform and the API gateway call record data for event triggering mechanism analysis, obtaining the corresponding event triggering mechanism adjustment strategy to update and adjust the API gateway processing logic, obtaining the key interface request peak timing data after the processing logic is updated, performing request call frequency analysis based on the key interface request peak timing data to obtain the response delay timing data during the high-load period, optimizing and adjusting the real-time parameters of the serverless function based on the response delay timing data during the high-load period, obtaining the event processing log of the security detection engine after the real-time parameters are optimized, performing abnormal request analysis based on the event processing log to obtain the abnormal detection coverage rate, and when the abnormal detection coverage rate reaches the preset coverage rate requirement, obtaining the abnormal traffic data corresponding to the abnormal event, and performing cluster analysis on the abnormal traffic data to obtain the abnormal event classification result. Compared with the existing technology, this cloud computing-based e-commerce platform network security monitoring method adopts a function real-time parameter optimization and adjustment mechanism that dynamically analyzes the call event trigger mechanism based on serverless function operation logs and API gateway call records, combined with the innovative design of the abnormal request analysis mechanism based on the security detection engine event processing log. It can effectively perceive the black box characteristics and multi-stage collaborative call characteristics of serverless functions, improve the efficiency, comprehensiveness and accuracy of security threat risk detection, provide reliable technical support for real-time intelligent security detection of e-commerce platforms under high concurrent load scenarios, and ensure the continuous safe and stable operation of e-commerce platforms under high load scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 1 is a flow chart of a method for monitoring network security of an e-commerce platform based on cloud computing in an embodiment of the present invention;

[0058] Figure 2 It is a structural diagram of a network security monitoring system for an e-commerce platform based on cloud computing in an embodiment of the present invention. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical solutions and beneficial effects of the present invention more clear, the present invention is further described in detail below with reference to the accompanying drawings and embodiments. Obviously, the embodiments described below are part of the embodiments of the present invention and are only used to illustrate the present invention, but are not used to limit the scope of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0060] In one embodiment, Figure 1 As shown, a cloud computing-based e-commerce platform network security monitoring method is provided, comprising the following steps:

[0061] S11. Obtain the operation log data and API gateway call record data of the serverless function on the e-commerce platform, and perform event trigger mechanism analysis based on the operation log data and the API gateway call record data to obtain the corresponding event trigger mechanism adjustment strategy.

[0062] The operation log data in this embodiment can be understood as the self-operation information of the serverless function within a certain data collection time range obtained according to the information analysis time requirement, including data such as trigger execution time, operation status, operation steps and operation end time; similarly, the API gateway call record data can also be understood as the call information of the serverless function on the API gateway within a certain data collection time range obtained according to the information analysis time requirement, including data such as call time, number of calls and call results. Taking into account that both the operation log data and the API gateway call record data contain function lifecycle data and are convenient for capturing function trigger mechanism information, in order to ensure the timeliness and rationality of the call event-driven perception, this embodiment preferably combines the operation log data and the API gateway call record data to perform efficient and reliable analysis of the call event trigger mechanism during the current operation of the e-commerce platform and perform adaptive optimization and adjustment.

[0063] Specifically, the step of analyzing the event trigger mechanism based on the operation log data and the API gateway call record data to obtain the corresponding event trigger mechanism adjustment strategy includes:

[0064] Obtain a corresponding function call time series based on the operation log data. The function call time series can be understood as a sequence consisting of each execution time of the serverless function within the corresponding data collection time range, sorted by the corresponding trigger execution time. Specifically, the step of obtaining the corresponding function call time series based on the operation log data includes:

[0065] According to the operation log data, an operation information set of the serverless function is obtained; the operation information set includes multiple operation records; wherein the operation record can be understood as the key information of a single operation of the serverless function, including the triggering time, execution status and operation end time.

[0066] According to the difference between the operation end time and the triggered time of each operation record in the operation information set, the function call duration of the corresponding operation record is obtained, and the corresponding triggered time is used to mark the function call duration to generate a function call duration data set; for example, if there are 10 operation records within a certain period of time, and the function call durations obtained based on the difference between the corresponding operation end time and the triggered time are 2 seconds, 3 seconds, 1.5 seconds, 1 second, 4 seconds, etc., respectively, then the generated function call duration data set includes the duration of each function call and the corresponding timestamp (the triggered time in the operation record).

[0067] The function call durations in the function call duration data set are sorted according to the corresponding triggered times to generate a corresponding initial call duration time series.

[0068] Based on the preset sliding window, the long time series during the initial call is smoothed to obtain the long time series during the function call; wherein, the preset sliding window can be selected according to the actual application requirements and the distribution characteristics of the data, such as 5 function runs as a window; after determining the preset sliding window, the average duration of the function call in each preset sliding window can be calculated based on the long time series during the initial call as the smoothed data value of the corresponding window, and then the smoothed data values ​​corresponding to each window can be sorted in chronological order to obtain the required long time series during the function call, so as to facilitate a more accurate analysis of the call event trigger interval in the subsequent process.

[0069] According to the triggering time corresponding to the duration of each function call in the long time series when the function is called, the API gateway call record data is traversed to obtain the corresponding function call record, and the function call record data set is generated based on all the function call records; wherein, the function call record data set can be understood as a data set composed of function call information with corresponding timestamps obtained by traversing the API gateway call record data according to the corresponding timestamp information of each data in the long time series when the function is called, and each function call record includes the call time, call result and response time, and the call time is the time when the function is called, the call result is the return status after the function call (which can reflect whether the call is successful or not), and the corresponding response time can be understood as the return time of the call result.

[0070] This embodiment uses the long time series of function calls obtained through analysis of the running log data to reversely search the function call data in the API gateway call record data, which can effectively identify the situation where the function call event is triggered abnormally due to malicious code injection at the function code level; in actual applications, if the required function call record data set cannot be obtained based on the timestamp information corresponding to the data in the long time series of function calls, it can be considered that there is a mismatch between the function call and the actual operation of the function, and corresponding early warning processing can be performed based on the security threat of abnormal function operation due to code injection or theft of platform operation data. Conversely, the call event triggering mechanism can be further analyzed based on the function API gateway call record data.

[0071] An event trigger mechanism analysis is performed based on the function call record data set to obtain a corresponding event trigger mechanism adjustment strategy; wherein the event trigger mechanism adjustment strategy can be understood as an API gateway processing logic update rule for optimizing resource allocation and balancing event processing delays, obtained by analyzing the stability of the platform's responsiveness based on the distribution of function call duration intervals during the current platform operation. Specifically, the step of performing an event trigger mechanism analysis based on the function call record data set to obtain a corresponding event trigger mechanism adjustment strategy includes:

[0072] A corresponding function call response delay sequence is obtained based on the difference between the response time and the call time of each function call record in the function call record data set; wherein the function call response delay data at each time point in the function call response delay sequence is the function response delay value obtained by subtracting the response time and the call time of each function call record in the function call record data set.

[0073] According to the difference between the call times of two adjacent function call records in the function call record data set, a corresponding function call time interval sequence is obtained; wherein the function call interval data at each time point in the function call time interval sequence is the time interval between two consecutive function calls in the function call record data set.

[0074] According to the function call response delay sequence and the function call time interval sequence, a corresponding function call frequency is obtained, and a target sliding window size is obtained according to the function call frequency. The function call frequency can be understood as taking into account that the function response delay may be related to the dynamic changes of the actual platform operation environment such as network congestion or system overload. In order to more reasonably evaluate the function call frequency during the platform operation process, this embodiment preferably adopts a method of dynamically weighting the time interval using the delay definition sequence weight to obtain the required function call frequency. The specific function call frequency can be expressed as:

[0075]

[0076] Where,

[0077]

[0078] in, Indicates the function call frequency; and Respectively represent the function call time interval and function call response delay corresponding to the i-th time point in the function call time interval sequence and function call response delay sequence; Represents the weight of the function call time interval corresponding to the i-th time point in the function call time interval sequence; Indicates the number of data in the function call time interval sequence and function call response delay sequence.

[0079] The target sliding window size in this embodiment can be understood as the optimal data window size for smoothing the function call time interval sequence, which is preferably determined based on the function call frequency. After obtaining the function call frequency through the above method steps, the maximum number of data points in the window can be limited based on the The window time span is calculated, where Indicates the target sliding window size; Indicates the maximum number of data points allowed in the window; or, from the perspective of smoothing delay, based on The window time span is calculated, where Indicates the maximum allowed delay within the window.

[0080] The function call time interval sequence is smoothed according to the target sliding window size to obtain a corresponding call event trigger interval time sequence; wherein, the process of obtaining the call event trigger interval time sequence can be understood as first smoothing the function call time interval sequence according to the target sliding window size to obtain a smoothed function call time interval sequence. The specific smoothing process can be referred to the relevant existing technology and will not be described in detail here.

[0081] Based on the autoregressive model, a trend analysis is performed on the time series of the call event trigger interval, and the event trigger mechanism adjustment strategy is generated according to the corresponding trend analysis results. Among them, the trend analysis results may include the trigger interval gradually extending over time, or the trigger interval gradually shortening over time; when the trend analysis result shows that the trigger interval gradually extends over time, it means that the current event call frequency is too slow, and the event needs to be processed first in the future to avoid the gradual increase in platform load pressure; when the trend analysis result shows that the trigger interval gradually shortens over time, it means that the current event call frequency is very fast, and the response speed can be appropriately reduced within the allowable conditions to give way to event scheduling with higher response delays. In practical applications, after obtaining trend analysis results corresponding to a call event trigger interval time series based on an autoregressive model, corresponding adjustment policies can be obtained based on a pre-set policy table that includes event trigger mechanism adjustment rules corresponding to different trend analysis results. For example, if the trend analysis result corresponding to a call event trigger interval time series shows that the trigger interval gradually increases over time, the forwarding efficiency can be improved by modifying dynamic routing rules based on the degree of deviation between the average trigger interval of the call event trigger interval time series and the preset trigger interval adjustment threshold. Alternatively, the rate, concurrency, or burst traffic threshold limits of the relevant API can be dynamically modified, or the cache lifetime can be dynamically adjusted to allocate more processing resources to the current event trigger mechanism. Of course, if the trend analysis result corresponding to the call event trigger interval time series shows that the trigger interval gradually decreases over time or the average delay decreases to the corresponding minimum delay threshold (the delay threshold used to determine whether there is resource waste), processing resource transfer adjustments can be made using methods related to the gradual extension of the trigger interval to improve platform resource utilization efficiency and effectively balance event scheduling response delays.

[0082] This embodiment determines the function call frequency by comprehensively analyzing the function call response delay and the function call time interval, and then smoothes the function call time interval sequence based on the target sliding window size selected based on the function call frequency to obtain the call event trigger interval. This method can timely perceive the irrationality of the API gateway event call mechanism during the platform operation and timely and reliably optimize and adjust the API gateway processing logic, effectively improving the adaptability of the platform's operating environment and providing reliable protection for event response efficiency under high load.

[0083] S12. Update and adjust the API gateway processing logic according to the event trigger mechanism adjustment strategy, and obtain the peak timing data of key interface requests after the processing logic is updated; among them, the specific implementation strategy for updating and adjusting the API gateway processing logic according to the event trigger mechanism adjustment strategy can refer to the modification of dynamic routing rules in the existing cloud computing platform, the limitation of API rate, concurrency or burst traffic threshold, and the specific implementation technology of dynamically adjusting the cache lifetime, which will not be described in detail here.

[0084] In this embodiment, the key interface request peak timing data can be understood as the event interface request peak timing data that has a greater impact on the operating performance of the e-commerce platform. Taking into account the high-load operation of the e-commerce platform (platform promotion scenario), the request volume of the product details page interface and the order submission interface varies greatly and needs to be paid special attention. In this embodiment, the product details page request and the order submission interface request are preferably used as the analysis objects for real-time parameter optimization. The corresponding key interface request peak timing data includes the product details page request peak timing data and the order submission interface request peak timing data. It should be noted that in actual applications, the key interface request peak timing data can also be adjusted according to actual application requirements, and the corresponding analysis method below can still be used.

[0085] In order to ensure the accuracy of the subsequent analysis of the response delay of the serverless function in the high-load period after the API gateway processing logic is updated, this embodiment preferably obtains the function call record data of a certain length after the API gateway processing logic is updated and adjusted, and performs the corresponding event trigger interval time analysis again to obtain the adjusted call event trigger interval; then obtains the key interface request peak timing data within the call event trigger interval; it should be noted that the acquisition process of the adjusted call event trigger interval sequence may include: first, according to the call time difference of adjacent function call records in the obtained function call record data, obtain the call time interval sequence; then select the sliding window to smooth the call time interval sequence to obtain the smoothed call time interval sequence; then, obtain the average call time interval of the smoothed call time interval sequence to obtain the required call event trigger interval, which is convenient for the subsequent analysis of the key interface request response of the platform during the high-load period, so as to optimize and adjust the real-time parameters of the serverless function.

[0086] S13. Perform a request call frequency analysis based on the peak timing data of key interface requests to obtain response delay timing data during high-load periods. Based on the response delay timing data during high-load periods, optimize and adjust the real-time parameters of the serverless function. The response delay timing data during high-load periods can be understood as the average response delay timing data of all key interface requests under high-load conditions.

[0087] Specifically, the step of performing request call frequency analysis based on the critical interface request peak time series data to obtain the high-load period response delay time series data includes:

[0088] According to the peak timing data of various key interface requests, the corresponding high-load period request function call records are obtained, and according to the high-load period request function call records, the corresponding high-load period request function call frequency timing data are obtained; wherein, the high-load period request function call records can be understood as the key interface call data (interface is equivalent to function) obtained from the function call records of the API gateway based on the timestamp range corresponding to the key interface request peak timing data, and also include the call time, call results and response time at different call time points. The acquisition process of the corresponding high-load period request function call frequency timing data includes first performing time period statistics on the key interface call data in the high-load period request function call records according to the timing data interval of the key interface request peak timing data, obtaining the key interface call frequency in each timing data interval, and then arranging the key interface call frequencies in each timing data interval in order to obtain the required high-load period request function call frequency timing data.

[0089] The peak time series data of various key interface requests are compared with the data at different moments in the corresponding high-load period request function call frequency time series data, and the corresponding high-load period event trigger interval time series data is generated based on the difference between the sequence moment when the request function call frequency is greater than the key interface request peak and the previous moment. Among them, the high-load period event trigger interval time series data can be understood as taking into account the fact that under high load conditions, due to low function execution efficiency, unexpected request volume, or inconsistent request processing speed, it is very easy for the request function call frequency to not match the request peak data. The event trigger exception time interval sequence obtained by extracting the event exception trigger interval is when the processing efficiency of the key interface request function cannot keep up with the interface request rate. It should be noted that the request function call frequency greater than the key interface request peak indicates that there is a certain delay or waiting time in the function processing request, resulting in the function being frequently called and the processing time of each call being long. The high-load period event trigger interval time series data is extracted based on this and is used to analyze the request response delay during the high-load period and to optimize and adjust the real-time parameters of the relevant serverless functions, which can effectively improve the platform request processing efficiency and platform operation stability under high load conditions.

[0090] According to the high-load period event trigger interval timing data, the corresponding security detection engine response duration timing data is obtained, and according to the difference between the high-load period event trigger interval timing data and the security detection engine response duration timing data, the high-load period response delay timing data corresponding to the peak timing data of each key interface request is generated; wherein, the security detection engine response duration timing data can be understood as the timing data composed of the security detection response duration corresponding to the security detection engine (pre-deployed on the e-commerce platform) obtained based on each event trigger interval in the high-load period event trigger interval timing data; the specific collection of the security detection engine response duration timing data can refer to the relevant existing technology implementation and will not be described in detail here. Considering that in actual applications, the response delay of various key interface request processing functions actually includes two parts: the security detection duration and the request function's own processing delay. In order to more accurately analyze the actual processing delay of each key interface request under high load conditions and provide a reliable adjustment basis for the subsequent real-time parameter optimization of the serverless function, this embodiment preferably obtains the corresponding request event response delay data based on the difference between the high-load period event trigger interval and the corresponding security detection engine response duration.

[0091] The high-load period response delay timing data is obtained according to the average timing data of the high-load period response delay timing data corresponding to the peak timing data of each type of key interface request; that is, the high-load period response delay timing data is a sequence composed of the average values ​​of the response delay data of the corresponding time points in the high-load period response delay timing data corresponding to the peak timing data of each key interface request.

[0092] This embodiment combines the comparative analysis between request peaks and function call frequencies with the processing efficiency of the security detection engine to effectively ensure the reliability and authenticity of the extraction of processing delays of various key interface requests under high load, thereby providing reliable data support for subsequent function parameter optimization.

[0093] The real-time parameter optimization and adjustment in this embodiment can be understood as dynamically adjusting the configuration parameters of serverless functions that are strongly related to response delays during high-load periods during actual platform operation, thereby effectively improving the processing efficiency of serverless functions and the overall operating performance of the platform under high-load scenarios. Specifically, the step of optimizing and adjusting the real-time parameters of the serverless functions based on the high-load period response delay time series data includes:

[0094] An average response delay is obtained according to the response delay time series data during the high-load period.

[0095] Determine whether the average response delay is greater than the expected delay response threshold. If so, obtain the corresponding actual response delay deviation; wherein, the expected delay response threshold can be set according to actual application requirements and is not specifically limited here; the corresponding actual response delay deviation is the difference between the average response delay and the expected delay response threshold.

[0096] Based on the deviation range corresponding to the actual response delay deviation, a real-time parameter adjustment strategy for the serverless function is generated. The deviation range can be understood as a response delay deviation interval pre-set based on empirical knowledge, reflecting different levels of delay. For example, a deviation between 0 and 0.2 seconds represents a slight delay, a deviation between 0.2 and 0.5 seconds represents a moderate delay, and a deviation greater than 0.5 seconds represents a severe delay. In actual applications, the delay level can be determined based on the deviation range corresponding to the specific actual response delay deviation, and then a corresponding real-time parameter adjustment strategy can be matched based on the delay level. It should be noted that the matching relationship between different delay levels and real-time parameter adjustment strategies can be established in advance through research and analysis. The corresponding real-time parameter adjustment strategies may include: adjusting concurrency (dynamically increasing concurrent processing threads) to avoid resource waste and function timeouts, enabling faster processing of the request queue and thereby improving response speed; adjusting function timeouts (reasonably shortening the function timeout wait period) to avoid long function execution times; adjusting memory configuration (dynamically adjusting the function configuration memory space range) to improve function execution efficiency; and adjusting the platform log level (dynamically increasing the log printing level) to reduce log overhead and function latency.

[0097] According to the real-time parameter adjustment strategy of the serverless function, the real-time parameters are optimized and adjusted; the specific optimization and adjustment of the real-time parameters can be based on the adjustment strategy content in the obtained real-time parameter adjustment strategy, and the serverless function can be dynamically configured and adjusted with reference to relevant existing technologies, which will not be described in detail here.

[0098] This embodiment generates a real-time parameter adjustment strategy based on the response delay analysis of the peak timing data of various key interface requests during high-load periods for optimizing the request response performance of serverless functions, effectively improving the request processing efficiency and platform resource occupancy rate in high-load scenarios, and effectively ensuring the continuous and stable operation of the e-commerce platform in high-load scenarios.

[0099] S14. Obtain the event processing log of the security detection engine after the real-time parameters are optimized, and perform abnormal request analysis based on the event processing log to obtain abnormal detection coverage; wherein, the event processing log of the security detection engine can be understood as the processing log information recording all abnormal request events detected by the security detection engine. The corresponding abnormal detection coverage can be understood as the completeness of abnormal request event detection after the real-time parameters of the serverless function are optimized, so as to determine whether there is an underreporting situation; specifically, the step of performing abnormal request analysis based on the event processing log to obtain abnormal detection coverage includes:

[0100] Based on a preset log extraction technology, abnormal request data is extracted from the event processing log to generate a corresponding abnormal request dataset. The abnormal request dataset can be understood as a collection of abnormal request data recorded in the event processing log, and the abnormal request data includes the request type, request timestamp, and corresponding inspection results. The corresponding preset log extraction technology can be selected based on actual application requirements. For example, Python can be used to parse the log and extract relevant log content based on preset keyword information, or abnormal request data can be extracted based on preset regular expressions. These are not specifically limited here.

[0101] Statistical analysis is performed on the abnormal request data set to obtain the corresponding abnormal trigger frequency; wherein, the abnormal trigger frequency can be understood as the ratio of the number of corresponding abnormal requests in the abnormal request data set to the corresponding duration. An increase in the abnormal trigger frequency indicates that the frequency of detection engine calls has increased, which in turn shows that the serverless real-time parameter adjustment has taken effect.

[0102] According to the abnormal trigger frequency, determine whether the real-time parameter adjustment is effective. If so, obtain the abnormal request event count of the security detection engine in the corresponding time period, and match and analyze the abnormal request event count and the log abnormal request record in the corresponding time period to obtain the abnormal detection coverage; wherein, the abnormal detection coverage can be understood as the ratio of the abnormal request event count to the number of abnormal detections in the log abnormal request record; if the security detection engine can detect all abnormal requests, the abnormal request event count in the same time period should be the same as the number of abnormal detections in the log abnormal request record, that is, the corresponding abnormal detection coverage is 100%; if the security detection engine fails to identify some abnormal requests due to unreasonable real-time parameter adjustment, the number of abnormal requests in the log abnormal request record will be greater than the abnormal request event count counted by the security detection engine, that is, the security detection engine will miss a report, and the corresponding abnormal detection coverage is less than 100%.

[0103] In this embodiment, the real-time parameter optimization adjustment is ensured to be effective based on monitoring the abnormal trigger frequency, and a comparative analysis is performed based on the abnormal request event count of the security detection engine and the abnormal request record of the platform log within the same request processing period to reliably evaluate the comprehensiveness of abnormal detection after the real-time parameter optimization adjustment, providing an effective analysis basis for effectively balancing the real-time nature of request processing and the comprehensiveness of abnormal request detection.

[0104] S15. When the anomaly detection coverage reaches the preset coverage requirement, the abnormal traffic data corresponding to the abnormal event is obtained, and the abnormal traffic data is clustered and analyzed to obtain the abnormal event classification result. Among them, the preset coverage requirement can be understood as setting the coverage condition based on the actual application requirements of balancing the real-time nature of request processing and the comprehensiveness of abnormal request detection. In this embodiment, it is preferably set to the anomaly detection coverage being greater than the historical abnormal event detection coverage and the anomaly detection coverage being higher than the preset coverage threshold, that is, the real-time parameter adjustment will not lead to a decrease in anomaly detection coverage; if the anomaly detection coverage does not meet the preset coverage requirement, it is considered that the current corresponding real-time parameter adjustment is not reasonable and further fine-tuning is required. When the fine-tuned anomaly detection coverage reaches the preset coverage requirement, the abnormal event classification process is performed; it should be noted that the specific fine-tuning strategy can be determined according to actual conditions.

[0105] The abnormal traffic data in this embodiment can be understood as data corresponding to abnormal requests identified by the security detection engine, and may include information such as the IP address, request time, and request frequency of each abnormal data flow. Specifically, the step of performing cluster analysis on the abnormal traffic data to obtain abnormal event classification results includes:

[0106] Based on request time, the abnormal traffic data is clustered and analyzed to generate multiple clusters. These clusters directly reflect the temporal distribution of abnormal traffic data, facilitating analysis of the relationship between abnormal events and traffic changes. For example, 50 abnormal requests were clustered by time to yield three groups: 20 requests in the first five minutes of a promotion, 15 requests in the middle, and 15 requests at the end, suggesting that the anomaly may be related to a traffic spike. To further understand the underlying cause of the anomaly, the following steps are required to refine the anomaly type.

[0107] Based on the preset classification algorithm, the abnormal traffic data of each cluster is classified and predicted to obtain multiple abnormal event groups; among them, the preset classification algorithm preferably uses simple rule classification, and can subdivide the abnormal traffic data of each cluster into high-frequency attacks and abnormal accesses according to the request frequency. For example, a request frequency higher than 3 times / second is classified as a high-frequency attack, and a request frequency lower than this standard is classified as an abnormal access, and finally the abnormal event groups corresponding to each cluster are obtained.

[0108] Based on the preset neural network model, abnormal features are extracted from the abnormal traffic data of each abnormal event group to obtain the corresponding abnormal event features; among them, the preset neural network model can select a neural network structure that can realize the abnormal traffic data feature extraction function. The specific abnormal event feature extraction process can refer to the relevant neural network model feature extraction implementation technology, which will not be described in detail here.

[0109] The abnormal event characteristics and clusters corresponding to each abnormal event group are matched and analyzed with the preset abnormal pattern knowledge base to obtain the corresponding abnormal event pattern; among which, the preset abnormal pattern knowledge base can be understood as a database of abnormal event patterns and abnormal source category records of abnormal event characteristics under different abnormal time distribution locations, which is constructed in advance based on abnormal traffic analysis experience.

[0110] According to the abnormal source category corresponding to the abnormal event pattern, the abnormal event classification corresponding to the abnormal traffic is obtained; the abnormal event classification includes gang attacks and order-brushing behaviors.

[0111] According to the abnormal event classification of all abnormal traffic, the abnormal event classification result is obtained.

[0112] The embodiment of the present invention provides an event trigger mechanism analysis based on the operation log data of the serverless function and the API gateway call record data obtained on the e-commerce platform, obtains the corresponding event trigger mechanism adjustment strategy to update and adjust the API gateway processing logic, obtains the key interface request peak timing data after the processing logic is updated, and performs request call frequency analysis based on the key interface request peak timing data to obtain the high-load period response delay timing data, and then optimizes and adjusts the real-time parameters of the serverless function based on the high-load period response delay timing data, and obtains the event processing log of the security detection engine after the real-time parameters are optimized, and performs abnormal request analysis based on the event processing log to obtain abnormal Detection coverage, and when the anomaly detection coverage reaches the preset coverage requirement, the abnormal traffic data corresponding to the abnormal event is obtained for cluster analysis to obtain the abnormal event classification result. The technical solution is based on the real-time parameter optimization and adjustment mechanism of the function that dynamically analyzes the call event trigger mechanism based on the operation log data of the serverless function and the API gateway call record. Combined with the innovative design of the abnormal request analysis mechanism based on the security detection engine event processing log, it effectively perceives the black box characteristics and multi-stage collaborative call characteristics of the serverless function, which can improve the efficiency, comprehensiveness and accuracy of security threat risk detection, and provide reliable technical support for real-time intelligent security detection of e-commerce platforms under high concurrent load scenarios.

[0113] In addition, considering that in actual applications, the computational overhead corresponding to various abnormal event detection rules will affect the operating performance of the e-commerce platform; in order to ensure the operational stability of the e-commerce platform while ensuring the network security of the e-commerce platform, this embodiment preferably also optimizes and adjusts the detection rules based on the correlation analysis between the running status of the detection function corresponding to different abnormal event classifications and performance resources. Specifically, the method also includes:

[0114] Obtain the detection function running status time series data corresponding to different abnormal event classifications in the abnormal event classification results, and perform performance resource fluctuation correlation analysis based on the detection function running status time series data, and update the abnormal event detection rules based on the corresponding correlation analysis results; wherein, the detection function running status time series data can be understood as the real-time running data of the function pre-deployed inside the security detection engine for detecting various abnormal events, including the function single execution time-consuming subsequence, function call frequency sequence and function call error rate sequence.

[0115] The performance resource fluctuation correlation analysis in this embodiment can be understood as calculating correlation coefficients (e.g., using the Pearson correlation coefficient method) between each subsequence in the detection function's operating state time series data and the various performance resource occupancy subsequences in the platform performance resource occupancy time series data collected during the same time period. This method yields correlations between each of the detection function's operating states and the fluctuations of various key performance resources. The corresponding platform performance resource occupancy time series data can be collected based on actual analysis requirements and may include CPU usage time series data and memory occupancy time series data, which are not specifically limited here. After determining that there is a strong correlation between a certain platform's performance resource occupancy and a certain running state of a detection function, the platform's performance resource occupancy subsequences can be grouped based on the corresponding preset resource occupancy range, and then the alarm threshold parameters of the corresponding running state in the corresponding detection rule can be appropriately adjusted according to the average value of the corresponding running state data of the detection function corresponding to different groups; for example, the single execution time threshold for triggering an alarm for a certain type of detection function's detection rule is 60 milliseconds, and a comparison of the CPU occupancy group data that is strongly correlated with the single execution time shows that the single execution time corresponding to the high CPU occupancy group often reaches 80 milliseconds, and the single execution time of the low CPU occupancy group has reached 55 milliseconds. This means that the current single execution time threshold for triggering an alarm for a certain type of detection function's detection rule is of low applicability and prone to false alarms. The parameters can be adjusted to generate new rules and set a timed detection update cycle.

[0116] The embodiments of the present invention can not only optimize and adjust the function real-time parameters based on the dynamic analysis of the call event trigger mechanism based on the serverless function operation log and API gateway call record, but also combine the innovative design of the abnormal request analysis mechanism based on the security detection engine event processing log to effectively perceive the black box characteristics and multi-stage collaborative call characteristics of serverless functions, improve the efficiency, comprehensiveness and accuracy of security threat risk detection, and provide reliable technical support for real-time intelligent security detection of e-commerce platforms, but also effectively balance the real-time nature of abnormal detection and the platform operation performance overhead, and ensure the continuous and stable operation of the e-commerce platform under high concurrent load scenarios.

[0117] It should be noted that although the steps in the above flowchart are shown in sequence as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders.

[0118] In one embodiment, Figure 2 As shown, a cloud computing-based e-commerce platform network security monitoring system is provided, the system comprising:

[0119] Trigger mechanism analysis module 1 is used to obtain the operation log data and API gateway call record data of the serverless function on the e-commerce platform, and perform event trigger mechanism analysis based on the operation log data and the API gateway call record data to obtain the corresponding event trigger mechanism adjustment strategy;

[0120] Trigger mechanism update module 2, used to update and adjust the API gateway processing logic according to the event trigger mechanism adjustment strategy, and obtain the call event trigger interval after the processing logic is updated;

[0121] Function parameter optimization module 3, configured to analyze the request call frequency based on the peak time series data of the key interface requests, obtain the response delay time series data during the high-load period, and optimize and adjust the real-time parameters of the serverless function based on the response delay time series data during the high-load period;

[0122] Detection coverage analysis module 4 is used to obtain the event processing log of the security detection engine after real-time parameter optimization, and perform abnormal request analysis based on the event processing log to obtain abnormal detection coverage;

[0123] The abnormal event classification module 5 is used to obtain abnormal traffic data corresponding to the abnormal event when the abnormal detection coverage reaches a preset coverage requirement, and perform cluster analysis on the abnormal traffic data to obtain an abnormal event classification result.

[0124] In one embodiment, a cloud computing-based e-commerce platform network security monitoring system is provided, the system further comprising:

[0125] A detection rule update module is used to obtain the detection function running status time series data corresponding to different abnormal event classifications in the abnormal event classification results, and perform performance resource fluctuation correlation analysis based on the detection function running status time series data, and update the abnormal event detection rules based on the corresponding correlation analysis results; the detection function running status time series data includes the function single execution time, function call frequency and function call error rate.

[0126] For the specific definition of the network security monitoring system of the e-commerce platform based on cloud computing, please refer to the definition of the network security monitoring method of the e-commerce platform based on cloud computing above. The corresponding technical effects can also be obtained equivalently, so they will not be repeated here. The various modules in the above-mentioned network security monitoring system of the e-commerce platform based on cloud computing can be implemented in whole or in part by software, hardware and their combination. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0127] In summary, the embodiment of the present invention provides a cloud computing-based e-commerce platform network security monitoring method and system. The cloud computing-based e-commerce platform network security monitoring method realizes obtaining the operation log data of the serverless function on the e-commerce platform and the API gateway call record data to perform event triggering mechanism analysis, obtains the corresponding event triggering mechanism adjustment strategy to update and adjust the API gateway processing logic, obtains the key interface request peak timing data after the processing logic is updated, performs request call frequency analysis based on the key interface request peak timing data to obtain the response delay timing data during the high-load period, optimizes and adjusts the real-time parameters of the serverless function based on the response delay timing data during the high-load period, obtains the event processing log of the security detection engine after the real-time parameters are optimized, and performs abnormal request processing based on the event processing log. The invention discloses a technical solution for analyzing and obtaining the anomaly detection coverage rate, and when the anomaly detection coverage rate reaches the preset coverage rate requirement, obtaining the abnormal traffic data corresponding to the abnormal event, and performing cluster analysis on the abnormal traffic data to obtain the abnormal event classification result. This method is based on the function real-time parameter optimization and adjustment mechanism that dynamically analyzes the call event triggering mechanism based on the serverless function running log and API gateway call record, combined with the innovative design of the abnormal request analysis mechanism based on the security detection engine event processing log, effectively perceiving the black box characteristics and multi-stage collaborative call characteristics of the serverless function, which can improve the efficiency, comprehensiveness and accuracy of security threat risk detection, and provide reliable technical support for the real-time intelligent security detection of the e-commerce platform under high concurrent load scenarios, ensuring the continuous safe and stable operation of the e-commerce platform under high load scenarios.

[0128] Each embodiment in this specification is described in a progressive manner, and the same or similar parts of each embodiment can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. It should be noted that the various technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the various technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0129] The above-described embodiments merely represent several preferred implementations of the present invention, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the patent. It should be noted that a person skilled in the art can make several improvements and substitutions without departing from the technical principles of the present invention, and such improvements and substitutions should also be considered within the scope of protection of the present invention. Therefore, the scope of protection of the patent for this invention shall be based on the scope of protection of the claims.

Claims

1. A network security monitoring method for an e-commerce platform based on cloud computing, characterized in that: The method comprises the following steps: Obtaining the running log data and API gateway call record data of the serverless function on the e-commerce platform, and performing event trigger mechanism analysis based on the running log data and the API gateway call record data to obtain the corresponding event trigger mechanism adjustment strategy; Update and adjust the API gateway processing logic according to the event trigger mechanism adjustment strategy, and obtain the peak timing data of key interface requests after the processing logic is updated; Performing request call frequency analysis based on the critical interface request peak timing data to obtain response delay timing data during a high-load period, and optimizing and adjusting the real-time parameters of the serverless function based on the response delay timing data during the high-load period; Obtaining an event processing log of the security detection engine after real-time parameter optimization, and performing abnormal request analysis based on the event processing log to obtain abnormal detection coverage; When the anomaly detection coverage reaches the preset coverage requirement, abnormal traffic data corresponding to the abnormal event is obtained, and cluster analysis is performed on the abnormal traffic data to obtain abnormal event classification results; The step of analyzing the event trigger mechanism based on the operation log data and the API gateway call record data to obtain the corresponding event trigger mechanism adjustment strategy includes: According to the running log data, obtaining the corresponding function call time series; According to the triggering time corresponding to the duration of each function call in the function call time series, the API gateway call record data is traversed to obtain the corresponding function call record, and the function call record data set is generated based on all the function call records; the function call record includes the call time, call result and response time; An event triggering mechanism analysis is performed based on the function call record data set to obtain a corresponding event triggering mechanism adjustment strategy.

2. The method for monitoring network security of an e-commerce platform based on cloud computing according to claim 1, wherein: The step of obtaining a long time series of the corresponding function call according to the operation log data includes: Obtaining an operation information set of the serverless function according to the operation log data; the operation information set includes multiple operation records; the operation records include a triggering time, an execution status, and an operation end time; Obtain the function call duration of the corresponding operation record based on the difference between the operation end time and the triggering time of each operation record in the operation information set, and mark the function call duration with the corresponding triggering time to generate a function call duration dataset; Sort the function call durations in the function call duration data set according to the corresponding triggering times to generate a corresponding initial call duration time series; Based on a preset sliding window, the long time series during the initial call is smoothed to obtain the long time series during the function call.

3. The method for monitoring network security of an e-commerce platform based on cloud computing according to claim 1, wherein: The step of analyzing the event trigger mechanism according to the function call record data set and obtaining the corresponding event trigger mechanism adjustment strategy includes: Obtaining a corresponding function call response delay sequence according to the difference between the response time and the call time of each function call record in the function call record data set; Obtaining a corresponding function call time interval sequence according to a difference between call times of two adjacent function call records in the function call record data set; Obtaining a corresponding function call frequency according to the function call response delay sequence and the function call time interval sequence, and obtaining a target sliding window size according to the function call frequency; Smoothing the function call time interval sequence according to the target sliding window size to obtain a corresponding call event triggering interval time sequence; A trend analysis is performed on the call event trigger interval time series based on an autoregressive model, and the event trigger mechanism adjustment strategy is generated according to the corresponding trend analysis result.

4. The method for monitoring network security of an e-commerce platform based on cloud computing according to claim 1, wherein: The key interface request peak time series data includes the product details page request peak time series data and the order submission interface request peak time series data; The step of performing request call frequency analysis based on the critical interface request peak time series data to obtain high-load period response delay time series data includes: According to the peak timing series data of various key interface requests, the corresponding high-load period request function call records are obtained, and according to the high-load period request function call records, the corresponding high-load period request function call frequency timing series data is obtained; Compare the peak time series data of various key interface requests with the data at different moments in the corresponding high-load period request function call frequency time series data in sequence, and generate the corresponding high-load period event trigger interval time series data based on the difference between the sequence moment when the request function call frequency is greater than the peak time of the key interface request and the previous moment; According to the high-load period event trigger interval timing data, the corresponding security detection engine response duration timing data is obtained, and according to the difference between the high-load period event trigger interval timing data and the security detection engine response duration timing data, the high-load period response delay timing data corresponding to the peak timing data of various key interface requests is generated; The high-load period response delay timing data is obtained according to the average timing data of the high-load period response delay timing data corresponding to the peak timing data of each type of key interface request.

5. The method for monitoring network security of an e-commerce platform based on cloud computing according to claim 1, wherein: The step of optimizing and adjusting the real-time parameters of the serverless function according to the high-load period response delay time series data includes: Obtaining an average response delay based on the response delay time series data during the high-load period; Determine whether the average response delay is greater than an expected delayed response threshold, and if so, obtain the corresponding actual response delay deviation; Generating a real-time parameter adjustment strategy for the serverless function according to a deviation range corresponding to the actual response delay deviation; According to the real-time parameter adjustment strategy of the serverless function, the real-time parameters are optimized and adjusted.

6. The method for monitoring network security of an e-commerce platform based on cloud computing according to claim 1, wherein: The step of analyzing abnormal requests according to the event processing log to obtain abnormal detection coverage includes: Based on the preset log extraction technology, the abnormal request data is extracted from the event processing log to generate a corresponding abnormal request data set; the abnormal request data includes the request type, request timestamp and corresponding inspection result; Performing statistical analysis on the abnormal request data set to obtain corresponding abnormal triggering frequencies; Based on the abnormal trigger frequency, determine whether the real-time parameter adjustment is effective. If so, obtain the abnormal request event count of the security detection engine in the corresponding time period, and match and analyze the abnormal request event count and the log abnormal request record in the corresponding time period to obtain the abnormal detection coverage.

7. The method for monitoring network security of an e-commerce platform based on cloud computing according to claim 1, wherein: The abnormal traffic data includes the IP address, request time and request frequency of each abnormal data flow; The step of performing cluster analysis on the abnormal traffic data to obtain abnormal event classification results includes: Based on the request time, cluster analysis is performed on the abnormal traffic data to obtain multiple clusters; Based on the preset classification algorithm, the abnormal traffic data of each cluster is classified and predicted to obtain multiple abnormal event groups; Based on the preset neural network model, abnormal features are extracted from the abnormal traffic data of each abnormal event group to obtain the corresponding abnormal event features; Match and analyze the abnormal event features and clusters corresponding to each abnormal event group with the preset abnormal pattern knowledge base to obtain the corresponding abnormal event pattern; According to the abnormal source category corresponding to the abnormal event pattern, the abnormal event classification corresponding to the abnormal traffic is obtained; the abnormal event classification includes gang attacks and order-brushing behaviors; According to the abnormal event classification of all abnormal traffic, the abnormal event classification result is obtained.

8. The method for monitoring network security of an e-commerce platform based on cloud computing according to claim 1, wherein: The method further comprises: Obtain the detection function running status time series data corresponding to different abnormal event classifications in the abnormal event classification results, and perform performance resource fluctuation correlation analysis based on the detection function running status time series data, and update the abnormal event detection rules based on the corresponding correlation analysis results; the detection function running status time series data includes the function single execution time, function call frequency and function call error rate.

9. A cloud computing-based e-commerce platform network security monitoring system, characterized in that: The system comprises: A trigger mechanism analysis module is used to obtain the operation log data and API gateway call record data of the serverless function on the e-commerce platform, and perform event trigger mechanism analysis based on the operation log data and the API gateway call record data to obtain the corresponding event trigger mechanism adjustment strategy; A trigger mechanism update module is used to update and adjust the API gateway processing logic according to the event trigger mechanism adjustment strategy, and obtain the key interface request peak time series data after the processing logic is updated; a function parameter optimization module, configured to analyze the request call frequency based on the peak timing data of the key interface requests, obtain the response delay timing data during the high-load period, and optimize and adjust the real-time parameters of the serverless function based on the response delay timing data during the high-load period; A detection coverage analysis module is used to obtain the event processing log of the security detection engine after real-time parameter optimization, and perform abnormal request analysis based on the event processing log to obtain abnormal detection coverage; An abnormal event classification module is used to obtain abnormal traffic data corresponding to the abnormal event when the abnormal detection coverage reaches a preset coverage requirement, and perform cluster analysis on the abnormal traffic data to obtain an abnormal event classification result; The performing of event trigger mechanism analysis based on the operation log data and the API gateway call record data to obtain a corresponding event trigger mechanism adjustment strategy includes: According to the running log data, obtaining the corresponding function call time series; According to the triggering time corresponding to the duration of each function call in the function call time series, the API gateway call record data is traversed to obtain the corresponding function call record, and the function call record data set is generated based on all the function call records; the function call record includes the call time, call result and response time; An event triggering mechanism analysis is performed based on the function call record data set to obtain a corresponding event triggering mechanism adjustment strategy.

Images