A cloud-edge collaborative security response method integrating policy self-generation and resource orchestration

Abstract

This invention relates to the field of network security technology, and more specifically to a cloud-edge collaborative security response method that integrates policy self-generation and resource orchestration. It proposes a policy self-generation mechanism that uses AI algorithms such as reinforcement learning to achieve dynamic and adaptive generation of security response policies, rather than relying on preset static rules. It also achieves automated orchestration of security response scripts, transforming high-level self-generated policies into executable atomic operation sequences, thus improving the level of response automation. Furthermore, it constructs a deep cloud-edge collaborative security response system that, through a unified communication and control module, achieves seamless collaboration and instruction distribution and execution of security capabilities between the cloud and the edge.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically to a cloud-edge collaborative security response method that integrates policy self-generation and resource orchestration. Background Technology

[0002] With the rapid development of cloud computing and edge computing technologies, modern network architectures are becoming increasingly complex and distributed. The cloud aggregates massive amounts of data and powerful computing capabilities, while the edge, being close to the data source, offers advantages such as real-time response and low latency. However, this distributed architecture also brings new security challenges. Traditional centralized security defense systems struggle to effectively cover and respond to security incidents occurring across both the cloud and the edge.

[0003] Existing security response methods typically rely on pre-defined security policies and manually written response workflows. For example, when faced with a known malicious IP address or domain name, a firewall will block it according to pre-defined rules. For more complex attacks, the defender will manually execute a series of response steps based on experience or standard operating procedures, such as isolating infected devices, performing source tracing analysis, and updating policies.

[0004] Some existing Security Automated Response (SOAR) platforms can automate the execution of predefined response procedures, improving response efficiency. However, these platforms often require security experts to predefine response procedures for various scenarios. For unknown or mutated threats, the development and updating of response scripts still rely on manual analysis and experience accumulation.

[0005] In existing technologies, traditional security response methods have the following drawbacks:

[0006] Insufficient response timeliness: Faced with rapidly changing distributed attacks and massive alerts, manual analysis and response speed is slow and cannot meet the needs of real-time response, which can easily lead to the escalation of security incidents.

[0007] Rigid strategies and poor adaptability: Existing security strategies and response procedures are usually preset and are difficult to dynamically adapt to the ever-evolving new threats, zero-day attacks or variant attack patterns, resulting in a situation of "running around in circles".

[0008] The challenges of cloud-edge collaborative response are significant: security information is fragmented between the cloud and the edge, and there is a lack of effective collaboration mechanisms, resulting in poor global visibility of security threats, difficulty in coordinating response actions, and an inability to form an integrated defense system.

[0009] The orchestration of handling processes relies on human experience: The writing and maintenance of automated response handling processes require a large amount of experience from security experts and are difficult to cover all potential complex scenarios, thus limiting the breadth and depth of automated responses. Summary of the Invention

[0010] In view of this, the present invention provides a cloud-edge collaborative security response method that integrates policy self-generation and resource orchestration, aiming to solve the problems of insufficient security response timeliness, poor policy adaptability, difficulty in cloud-edge collaboration, and excessive reliance on manual intervention in the orchestration of the handling process in the prior art, thereby improving the automation, intelligence and collaboration of security response.

[0011] To achieve the above objectives, the present invention adopts the following technical solution:

[0012] A cloud-edge collaborative security response method integrating policy self-generation and resource orchestration includes:

[0013] The system acquires and preprocesses security data from the cloud and edge to generate structured feature data. Based on this structured feature data, it performs cloud-edge situational awareness to generate a global security view. According to the global security view and environmental context, it dynamically generates security response strategies using a reinforcement learning algorithm. The security response strategies are parsed into executable atomic operation sequences to generate a security response handling process. This process is distributed to the cloud and edge via a collaborative communication module. The cloud and edge execute security response operations according to the process. The effectiveness of the security response operations is evaluated, feedback data is generated, and the reinforcement learning algorithm is optimized.

[0014] Furthermore, the step of acquiring and preprocessing security data from the cloud and edge to generate structured feature data includes: acquiring host logs and security device logs from the cloud and edge via a data acquisition agent; cleaning the host logs and security device logs to remove irrelevant noise logs; standardizing the format of the host logs and security device logs and mapping them to unified fields; and extracting structured feature data such as source IP, destination IP, and threat level from the logs with the unified fields.

[0015] Furthermore, based on the structured feature data, cloud-edge situational awareness is performed to generate a global system security view, including: performing correlation analysis based on the structured feature data, aggregating co-origin events and performing cross-domain correlation; establishing a behavioral baseline based on a time series model and detecting abnormal behaviors that deviate from the behavioral baseline; mapping the abnormal behaviors to an attack framework to generate an attack chain; and generating a global system security view containing event types, threat levels, and affected assets based on the attack chain and the correlation analysis results.

[0016] Furthermore, the method of dynamically generating a security response strategy using a reinforcement learning algorithm includes:

[0017] The network attack and defense scenario is modeled as a Markov decision process, defining a state space, an action space, and a reward function. Based on the state space and action space, a deep Q-network algorithm, a policy gradient algorithm, and a hybrid mode algorithm are used for training. The attack score and action score are quantified based on an expert knowledge base, and the state space is updated. The reward value of the defense action is calculated based on the reward function, and the optimal security response strategy is output.

[0018] Furthermore, the step of parsing the security response strategy into an executable sequence of atomic operations to generate a security response handling process includes: selecting corresponding atomic operations from an atomic operation library based on the security response strategy; combining the atomic operations into a structured security response handling process; optimizing the execution order of the security response handling process based on threat priority and cloud-edge resource availability; and converting the security response handling process into a JSON format instruction set.

[0019] Furthermore, the step of distributing the security response and handling process to the cloud and edge via the collaborative communication module includes: transmitting the security response and handling process based on the national cryptographic algorithm protocol; synchronizing threat intelligence and blacklist / whitelist data between the cloud and edge; detecting network status, and caching the security response and handling process if the network is disconnected; and redistributing the cached security response and handling process when the network is restored.

[0020] Furthermore, the cloud and edge terminals perform security response operations according to the security response and handling process, including: the cloud terminal adjusting firewall rules and security group policies by calling the cloud service API; the edge terminal updating the access control list through the local gateway; the cloud and edge terminals isolating the affected hosts; and based on the security response and handling process, synchronously executing defense operations at the cloud and edge terminals.

[0021] Furthermore, the step of evaluating the effectiveness of the security response operation and generating feedback data to optimize the reinforcement learning algorithm includes: collecting response time and attack suppression rate data of the security response operation; calculating a quantitative evaluation result based on the response time and attack suppression rate data; inputting the quantitative evaluation result as feedback data into the reinforcement learning algorithm; and updating the parameters of the reinforcement learning algorithm based on the feedback data to optimize subsequent policy generation.

[0022] Compared with the prior art, the present invention achieves the following technical effects:

[0023] 1. From passive defense to proactive intelligent response: Existing technologies mainly rely on known attack patterns and preset response procedures. This invention, through its self-generating strategy capability, can dynamically generate optimal security response and handling strategies based on the real-time situation of the system and changes in the environment. This enables the system to proactively adapt to and respond to unknown or mutated security threats, significantly improving its defense capabilities against zero-day attacks and new types of security attacks.

[0024] 2. Significantly Improved Response Efficiency and Automation: In existing security response mechanisms, the formulation of security response strategies and the arrangement of scenarios still require significant manual intervention. This invention, through the automation of strategy self-generation and scenario arrangement, seamlessly connects high-level security decisions with low-level execution actions, greatly shortening the mean time to detection (MTTD) and mean time to response (MTTR) of security incidents, reducing manual operations, and thus lowering security operating costs and the risk of human error.

[0025] 3. Achieving True Cloud-Edge Integrated Collaborative Defense: Existing technologies often present fragmented security response capabilities at the cloud and edge. This invention, through a collaborative communication and control module, breaks down information silos between the cloud and the edge, enabling unified management of security response strategies, precise command delivery, and real-time feedback of execution status. This allows the cloud and edge to form a closely coordinated, collaborative defense system, making it more efficient in responding to distributed security attacks. Attached Figure Description

[0026] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0027] Figure 1 This is a system architecture diagram of the present invention.

[0028] Figure 2 This is a flowchart illustrating the implementation of the present invention. Detailed Implementation

[0029] To further illustrate the technical means and effects of the present invention in achieving its intended purpose, the following detailed description of the specific implementation methods, structures, features, and effects of the present invention, in conjunction with the accompanying drawings and preferred embodiments, is provided below.

[0030] This invention provides a method for distributed cloud-edge node collaborative security defense and response, specifically including: acquiring and preprocessing security data from the cloud and edge to generate structured feature data; performing cloud-edge situational awareness based on the structured feature data to generate a global security view; dynamically generating a security response strategy using a reinforcement learning algorithm based on the global security view and environmental context; parsing the security response strategy into an executable sequence of atomic operations to generate a security response handling process; distributing the security response handling process to the cloud and edge through a collaborative communication module; the cloud and edge executing security response operations according to the security response handling process; evaluating the effectiveness of the security response operations and generating feedback data to optimize the reinforcement learning algorithm.

[0031] Specifically. (See reference) Figure 2 The specific process of the above steps is explained as follows.

[0032] Step 1: Data Acquisition and Preprocessing

[0033] This step involves acquiring terminal host logs and security device logs from the cloud and edge via a data acquisition agent; cleaning the host logs and security device logs to remove irrelevant and noisy logs; standardizing the format of the host logs and security device logs and mapping them to unified fields; and extracting structured feature data such as source IP, destination IP, and threat level from the logs with the unified fields.

[0034] Combination Figure 1 In the system architecture, the "Device Interaction Layer" and "Preprocessing Layer" are used. This step involves collecting various security-related data in real time from data acquisition agents deployed in the cloud and at the edge, or by utilizing existing log collection mechanisms. In the "Device Interaction Layer," data collection primarily takes place, including but not limited to host logs, security device logs (such as firewall logs, EDR logs, WAF logs, etc.), and other device logs and data sources. The collected raw data is then transmitted to the "Preprocessing Layer" for data processing, including cleaning, filtering, and feature extraction.

[0035] Data cleaning: Remove noise logs that are not related to security, such as frequent system heartbeat information;

[0036] Standardized formatting allows for the unified mapping of log formats such as Cef, Leef, Key-Value, and JSON to internal fields.

[0037] Timestamp standardization: All logs are standardized to UTC timestamps.

[0038] Data filtering: Based on predefined rules, preliminary screening is performed to reduce the workload of subsequent response processing, such as retaining only events with medium or high threat levels, or specific types of events such as login failures or malicious file detection.

[0039] Feature extraction: Extracting key structured features from unstructured / semi-structured logs. For example:

[0040] Extract source IP, source port, destination IP, destination port, protocol, action, rule ID, number of bytes, and connection status from firewall logs.

[0041] Extract process path, command line, parent process, hash value, detection name, threat level, and affected hosts from EDR alerts.

[0042] Extract attack type, request URL, request parameters, source IP, and User-Agent from WAF logs.

[0043] Step 2: Cloud-Edge Situational Awareness and Threat Identification

[0044] This step performs correlation analysis based on the structured feature data, aggregates co-origin events and performs cross-domain correlation; establishes a behavioral baseline based on a time series model, and detects anomalies that deviate from the behavioral baseline; maps the anomalies to an attack framework to generate an attack chain; and generates a global security view containing event type, threat level and affected assets based on the attack chain and correlation analysis results.

[0045] Combination Figure 1 The "Threat Identification" section of the "Preprocessing Layer" and the "Situational Awareness" section of the "Core Processing Layer" converge and integrate all preprocessed security data from the cloud and edge to construct a global security situational view. In the "Threat Identification" module, correlation analysis, behavioral analysis, and attack chain analysis are performed.

[0046] Correlation analysis is a crucial part of threat identification. It not only aggregates events from the same origin but also performs complex correlation analyses across origins and domains. For example, by correlating cracking attempts initiated by a specific IP address monitored in the cloud with port scanning activities of that IP address on internal servers at the edge, it can determine that this is a planned penetration attack, rather than a single, isolated incident.

[0047] Behavioral analysis: Based on time series models and statistical methods, a behavioral baseline for hosts / users / networks is established, including login frequency during normal working hours, the scope of internal services accessed, and network traffic patterns. Abnormal behaviors that significantly deviate from the baseline, such as a large number of external connections outside of working hours, access to uncommon ports / services, or abnormal privilege escalation, are marked as high-risk anomalies.

[0048] Attack chain analysis maps isolated events to tactics and techniques within the MITREATT&CK framework, thus linking discrete alerts and anomalous behaviors into a complete attack chain. For example, the system identifies a phishing email event (initial access), followed by the execution of a malicious script on the victim's host (execution), then lateral movement within the internal network (lateral movement), and finally data leakage (theft). This attack chain construction provides the context of the overall attack picture for subsequent strategy generation.

[0049] These analysis results are further input into the "Situation Awareness" module of the "core processing layer," which generates attack events through log correlation and alarm correlation. These events include a unique event ID, timestamp, event type (such as MalwareDetection, BruteForceAttempt, LateralMovement), threat level (such as Critical, High, Medium), confidence level, associated attack chain stage (TTPID), a list of affected assets (IP / Hostname), and original evidence (pointing to preprocessed log entries). The results are then used to generate a security view, identify threat trends, and conduct risk assessments.

[0050] This module can identify various security events such as DDoS attacks, intrusion attempts, malicious file transfers, lateral movement within the system, and data breaches, and use these as inputs to the policy self-generation module.

[0051] Step 3: Strategy Self-Generation

[0052] Combination Figure 1 The "Policy Self-Generation" section of the "Core Processing Layer" is one of the core innovations of this invention. Based on contextual information such as threat information, risk level, affected assets, and current cloud-edge environment resource status output by the cloud-edge situational awareness module, the policy self-generation module autonomously generates or recommends the optimal security response strategy. This module employs the following intelligent algorithms: 1) an expert system that provides preliminary strategies or auxiliary decisions based on preset rules and a knowledge base; 2) reinforcement learning that continuously learns and optimizes strategies by constructing an interaction model between the environment and the agent to maximize long-term security benefits.

[0053] Expert systems: For known threats with fixed patterns and well-defined characteristics (e.g., malicious IP access that matches high-confidence threat intelligence), expert systems can provide rapid and deterministic responses. An internal "IF-THEN" rule knowledge base is maintained. For example: "IF Threat Type == 'Known worm virus' AND Asset Type == 'Windows server' THEN Policy == 'Patch check and host isolation'". When alert information meets a specific rule paradigm, the system bypasses the time-consuming RL reasoning process and directly adopts the predefined strategy provided by the expert system, ensuring efficient and accurate responses.

[0054] Strategy Generation: The core technology applies Deep Reinforcement Learning (DRL) theory to model the network attack and defense process as a Markov Decision Process (MDP), thereby training an intelligent defense agent capable of autonomous decision-making. The dynamic generation of security response strategies using reinforcement learning algorithms includes: modeling the network attack and defense scenario as a Markov Decision Process, defining a state space, action space, and reward function; training the agent based on the state space and action space using Deep Q-Network, Policy Gradient, and Hybrid Mode algorithms; quantifying attack and action scores based on an expert knowledge base and updating the state space; calculating the reward value for defensive actions based on the reward function, and outputting the optimal security response strategy.

[0055] Technically speaking, strategy generation consists of the following two parts.

[0056] 1) Formalization of the attack and defense environment based on MDP

[0057] In order for the algorithm to understand and learn, the complex attack and defense scenarios first need to be mathematically represented.

[0058] State Space (S): The environmental state consists of two core matrices: the attack matrix A and the defense matrix D. The dimensions of these two matrices are determined by the number of devices and alarm types in the network. ij D represents the attack value of type j suffered by device i. ij This represents the defense value against the attack. To reflect the importance of network topology, the number of central media is introduced as the weight of each node. When calculating attack or defense scores, this weight is multiplied, making the offensive and defensive behaviors on key network nodes have a greater impact on the overall situation.

[0059] Action Space (A): The defender's action space is defined and finite. The agent's task is to select the optimal one or more combinations of actions from these actions as a strategy.

[0060] Reward Function (R): The reward mechanism is the core of guiding the agent's learning. Its design directly adopts the difference calculation method of the attack and defense matrix: Reward = (D...) ij -Aij )*a ij Where a ij It is a switch variable that only occurs when an attack is present on the node (A) ij Rewards are only calculated if the attack value is not equal to 0. This design intuitively incentivizes agents to take defensive actions that effectively "offset" the attack value.

[0061] 2) Core Algorithm and Training Mechanism

[0062] This invention employs three mainstream deep reinforcement learning algorithms as the core of policy generation and optimizes them in one go through an integrated training framework.

[0063] The core algorithm selection clearly defines and implements three types of defensive proxy algorithms: the Q-value-based DQN algorithm; the policy gradient-based POLICY (Reinforce) algorithm; and the hybrid PPO (Actor-Critic) algorithm.

[0064] Expert knowledge base-driven training: The model incorporates an expert knowledge base, which, based on expert knowledge, pre-quantifies the "attack score" for different security attack alerts and the "action score" for each defensive action against a specific attack. The training process is as follows:

[0065] ① The environment receives an attack alert and updates the attack matrix A based on the attack score in the knowledge base and the number of node center media.

[0066] ②The updated state S=[A,D] is input into the neural network.

[0067] ③The neural network outputs a defensive action D.

[0068] ④ The action is executed, and the defense matrix D is updated based on the action score in the knowledge base.

[0069] ⑤ Calculate the reward for this round using the reward function R, and feed the reward back to the neural network to update its parameters.

[0070] Ensemble and Inference: Experiments revealed that different algorithms have varying strengths and weaknesses when dealing with different attacks (e.g., the AC algorithm performs well under single attacks, while DQN has a higher win rate under multi-action attacks). Therefore, the final solution of this invention is an ensemble learning scheme that dynamically selects the optimal pre-trained model for real-time inference based on the attack type, outputting defense decisions. During real-time inference, the model only executes steps ①~③, without performing reward calculations or network updates, to ensure a fast security response.

[0071] The automatic policy generation function generates policies dynamically, which can adapt to new security threats and constantly changing network environments.

[0072] Step 4: Orchestration and Scheduling

[0073] This step, based on the security response strategy, selects the corresponding atomic operation from the atomic operation library; combines the atomic operations into a structured security response handling process; optimizes the execution order of the security response handling process based on threat priority and cloud-edge resource availability; and converts the security response handling process into a JSON format instruction set.

[0074] Combination Figure 1 In the "Orchestration and Scheduling" section of the "Core Processing Layer", this step receives the high-level security policy output by the policy self-generation module and transforms it into a series of executable, atomic security operation sequences, i.e., the security response and handling process.

[0075] This module includes an atomic operation library with a rich set of predefined safe operation atoms. Through dynamic orchestration capabilities, it can intelligently select and combine atomic operations from the atomic operation library to build a complete response and handling flow.

[0076] In order to accurately implement high-level strategies to the infrastructure, a three-tier task decomposition and scheduling architecture was designed.

[0077] Strategy Generation Layer (Upper Layer): This refers to the aforementioned strategy self-generation module. It is responsible for the highest-level decision-making and outputs a selected high-level strategy, such as "strong switching".

[0078] Policy parsing layer (middle layer): This is the core of orchestration and scheduling. This layer receives policies from the upper layer and parses and decomposes them into specific call instructions to the underlying infrastructure. For example, the "dynamic resource redundancy" policy will be parsed into API calls for horizontal scaling of Kubernetes Pods.

[0079] Action Execution Layer (Lower Layer): This is the layer that ultimately interacts with the infrastructure. It includes the ability to communicate with various platforms and devices, executing specific defense actions decomposed from the parsing layer by calling standardized SDKs or custom APIs.

[0080] The orchestration process involves cloud-edge adaptation, considering whether operations are executed in the cloud or at the edge, and generating targeted instruction sets. Finally, the scheduling engine, when scheduling the response flow, considers threat priority and cloud-edge resource availability to optimize scheduling order and resource allocation. The generated response flow is represented in a structured format—JSON—and is ready to be sent to the corresponding execution modules.

[0081] Step 5: Instruction Distribution

[0082] This step transmits the security response and handling process based on the national cryptographic algorithm protocol; synchronizes threat intelligence and blacklist / whitelist data between the cloud and the edge; detects network status, and if the network is disconnected, caches the security response and handling process; and redistributes the cached security response and handling process when the network is restored.

[0083] Combination Figure 1 In the "Response Execution" section of the "Preprocessing Layer", the disposal orchestration and scheduling module distributes specific security response instructions securely, reliably, and with low latency to the cloud security response execution module and / or the edge security response execution module based on the orchestrated disposal flow content through the collaborative communication and control module (represented in the diagram as instruction issuance and data synchronization).

[0084] Step 6: Security Response Execution (Cloud and Edge)

[0085] In this step, the cloud adjusts firewall rules and security group policies by calling the cloud service provider's API; the edge updates the access control list through the local gateway; the cloud and edge isolate the affected hosts; and based on the security response and handling process, defense operations are executed synchronously on both the cloud and edge.

[0086] Combination Figure 1 In the "Preprocessing Layer," specifically the "Response Execution" section, and in the "Device Control" section of the "Device Interaction Layer," this step involves receiving and executing instructions from the disposal orchestration and scheduling module at the cloud and / or edge. Within the "Preprocessing Layer," execution is divided into cloud-based response execution and edge-based response execution.

[0087] These actions are achieved through the device control capabilities of the "device interaction layer," including calling various APIs and SDKs, interacting with security services provided by cloud service providers, cloud-native security capabilities, and edge devices, local security gateways, and endpoint EDRs to perform specific defense operations, such as modifying cloud firewall rules, adjusting security group policies, isolating cloud hosts, disconnecting local network connections, and updating access control policies of edge node firewalls.

[0088] Step 7: Collaborative Communication and Control

[0089] Combination Figure 1 The "Response Execution" section of the "Preprocessing Layer" is responsible for bidirectional communication of all security-related information between the cloud and the edge. This is achieved through command issuance, status reporting, data synchronization, and protocol security using national cryptographic algorithms. It ensures reliable transmission of commands and statuses, guarantees the consistency of critical security data such as threat intelligence, whitelists, and blacklists between the cloud and the edge, and supports mechanisms such as reconnection after disconnection and message caching to cope with complex cloud-edge network environments.

[0090] Step 8: Effectiveness Evaluation and Feedback

[0091] This step collects response time and attack suppression rate data for the security response operation; calculates a quantitative evaluation result based on the response time and attack suppression rate data; inputs the quantitative evaluation result as feedback data into the reinforcement learning algorithm; and updates the parameters of the reinforcement learning algorithm based on the feedback data to optimize the generation of subsequent security policies.

[0092] This module is responsible for monitoring the effectiveness of security response and handling, collecting all data and results generated during the response process, and performing quantitative evaluation. Combined with... Figure 1 The "Response Evaluation" section of the "Preprocessing Layer" includes quantitative evaluation, which involves the quantitative analysis and collection of relevant data, including indicators such as response time, attack suppression rate, and resource consumption. The evaluation results serve as feedback to the strategy self-generation module, forming an intelligent closed loop: strategy generation -> action execution -> effect evaluation -> strategy optimization. Through continuous learning and feedback, the strategy self-generation algorithm continuously optimizes its decision-making model, enabling the system to become more intelligent, efficient, and adaptable over time.

[0093] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A cloud-edge collaborative security response method integrating policy self-generation and resource orchestration, characterized in that, The method comprises the following steps: Obtain security data from the cloud and edge and preprocess to generate structured feature data, including: Obtain host logs and security device logs from the cloud and edge through data collection agents; Clean the data of the host logs and security device logs, removing irrelevant noise logs; Standardize the format of the host logs and security device logs and map them to uniform fields; Extract structured feature data including but not limited to source IP, destination IP, threat level from the logs in the uniform fields; Perform cloud-edge situational awareness based on the structured feature data to generate a global security view; Generate a security response strategy dynamically based on the global security view and environmental context using a reinforcement learning algorithm, including: Model the network attack-defense scenario as a Markov decision process, define the state space, action space, and reward function; Train using deep Q-network algorithm, policy gradient algorithm, and hybrid mode algorithm based on the state space and action space; Update the state space based on expert knowledge base quantification of attack score and action score; Calculate the reward value of the defense action based on the reward function and output the optimal security response strategy; Parse the security response strategy into an executable atomic operation sequence to generate a security response handling process; Distribute the security response handling process to the cloud and edge through a collaborative communication module; The cloud and edge execute security response operations according to the security response handling process; Evaluate the effect of the security response operations and generate feedback data to optimize the reinforcement learning algorithm.

2. The method of claim 1, wherein, The method of obtaining security data from the cloud and edge and preprocessing to generate structured feature data comprises: Obtain host logs and security device logs from the cloud and edge through data collection agents; Clean the data of the host logs and security device logs, removing irrelevant noise logs; Standardize the format of the host logs and security device logs and map them to uniform fields; Extract structured feature data including but not limited to source IP, destination IP, threat level from the logs in the uniform fields.

3. The method of claim 1, wherein, The method of parsing the security response strategy into an executable atomic operation sequence to generate a security response handling process comprises: Select corresponding atomic operations from the atomic operation library based on the security response strategy; Combine the atomic operations into a structured security response handling process; Optimize the execution order of the security response handling process based on threat priority and cloud-edge resource availability; Convert the security response handling process into a JSON format instruction set.

4. The method of claim 1, wherein, The method of distributing the security response handling process to the cloud and edge through a collaborative communication module comprises: Transmit the security response handling process based on the SM algorithm protocol; Synchronize threat intelligence and black / white list data between the cloud and edge; Detect network status and cache the security response handling process if the network is disconnected; Redistribute the cached security response handling process when the network is restored.

5. The method of claim 1, wherein, The method of executing security response operations by the cloud and edge based on the security response handling process comprises: The cloud adjusts firewall rules and security group policies by calling the API of cloud services; The edge end updates an access control list through a local gateway; The cloud end and the edge end isolate the affected host; Based on the security response handling process, the defense operations of the cloud end and the edge end are synchronously executed.

6. The method of claim 1, wherein, The effect of the security response operation is evaluated and feedback data is generated, and the reinforcement learning algorithm is optimized, including: Collecting response time and attack suppression rate data of the security response operation; Based on the response time and attack suppression rate data, a quantitative evaluation result is calculated; The quantitative evaluation result is input as feedback data into the reinforcement learning algorithm; Based on the feedback data, the parameters of the reinforcement learning algorithm are updated, and the subsequent strategy generation is optimized.

Images