Cloud-native application security protection and monitoring method and system for financial technology

Abstract

The application provides a cloud-native application security protection and monitoring method and system for financial technology, relates to the technical field of network security of financial technology, and comprises the following steps: acquiring multidimensional monitoring data, establishing a security threat knowledge graph, identifying a high-risk attack path through a graph convolution network, generating a potential threat prediction result, identifying abnormal behavior, configuring a dynamic honeypot environment, recording the behavior trajectory of an attacker, analyzing attack intention and technical characteristics, and generating and deploying protection rules in real time. The application improves the security protection capability of a financial cloud environment and realizes intelligent threat prediction and active defense.

Description

Technical Field

[0001] This invention relates to the field of cybersecurity technology in financial technology, and in particular to a method and system for security protection and monitoring of cloud-native applications for financial technology. Background Technology

[0002] With the rapid development of fintech, more and more financial institutions are adopting cloud-native architectures to support their business operations. Cloud-native applications, due to their flexibility, scalability, and efficiency, have become the mainstream technology choice in the fintech field. However, the financial industry, as a high-value target for cyberattacks, faces increasingly complex and severe security challenges in its cloud-native environment. Traditional security protection methods mainly rely on static rules and matching of known features, which are insufficient to cope with dynamically changing security threats in the cloud-native environment. Financial cloud-native applications are characterized by distributed architecture, microservices, and containerization, significantly expanding the attack surface, making attack paths more complex, and greatly increasing the difficulty of identifying and protecting against security threats.

[0003] Existing security protection technologies for cloud-native financial technology applications suffer from the following shortcomings: Firstly, existing technologies often employ isolated monitoring data analysis methods, lacking the ability to comprehensively utilize and correlate multi-dimensional monitoring data. This hinders the establishment of a complete security threat knowledge system, resulting in limited understanding and early warning capabilities for complex attack chains. Secondly, existing security protection methods are primarily based on passive defense using known characteristics, lacking the ability to predict potential threats, especially advanced persistent threats (APTs) in financial transaction scenarios. This often leads financial institutions to only detect attacks after they have occurred, causing severe economic losses and reputational damage. Thirdly, existing technologies typically employ static protection strategies in threat response, lacking dynamic adaptability. They cannot adjust protection strategies in real time based on attacker behavior and intent, resulting in poor protection effectiveness, particularly during peak financial business periods, where insufficient protection or excessive false alarms are common.

[0004] With the deep integration of financial services and technology, the security of fintech cloud-native applications has become a key challenge for financial institutions' digital transformation. There is an urgent need for a security protection and monitoring method that can comprehensively utilize multi-dimensional monitoring data, perform intelligent threat prediction based on knowledge graphs, and dynamically adjust protection strategies to effectively address the increasingly complex security threats in the fintech cloud-native environment. Summary of the Invention

[0005] This invention provides a method and system for security protection and monitoring of cloud-native applications for financial technology, which can solve the problems in the prior art.

[0006] A first aspect of this invention provides a method for security protection and monitoring of cloud-native applications for fintech, comprising:

[0007] Obtain multi-dimensional monitoring data from fintech cloud-native applications;

[0008] An initial security threat knowledge graph is established based on the multi-dimensional monitoring data. Historical security events are semantically modeled according to the attack chain. A multi-level knowledge structure is established based on semantic correlation. A complete security threat knowledge graph is obtained based on the multi-level knowledge structure.

[0009] High-risk attack paths in the complete security threat knowledge graph are identified by graph convolutional networks. The high-risk attack paths are then matched with the multi-dimensional monitoring data. The probability of an attack is calculated based on threat association rules, and potential threat prediction results are generated.

[0010] Based on the potential threat prediction results, abnormal behavior is identified by calculating the deviation value of key monitoring indicators. When abnormal behavior is detected, the abnormal behavior characteristics are matched with the attack characteristics in the security threat knowledge graph to determine the threat type and threat level, and generate security threat alarm information.

[0011] The service fingerprint features of the security threat alarm information are extracted to configure a dynamic honeypot environment. The response characteristics of the dynamic honeypot environment are made consistent with the characteristics of the financial service currently under attack. Suspicious traffic is diverted to the dynamic honeypot environment through traffic mirroring technology. Marking code is implanted in the dynamic honeypot environment to record the attacker's behavior trajectory. The attacker's attack intent and technical characteristics are analyzed based on the behavior trajectory. Based on the attack intent and technical characteristics, protection rules for financial transaction scenarios are generated in real time and deployed to the financial business production environment.

[0012] An initial security threat knowledge graph is established based on the multi-dimensional monitoring data. Historical security events are semantically modeled according to the attack chain. A multi-level knowledge structure is established based on semantic correlation. A complete security threat knowledge graph is obtained based on the multi-level knowledge structure, including:

[0013] Entity nodes are generated based on the multi-dimensional monitoring data, and interaction relationships are extracted based on the interaction information between the entity nodes. The entity nodes and the interaction relationships are combined to form an initial security threat knowledge graph.

[0014] Based on the initial security threat knowledge graph, attack chains in historical security events are extracted, semantic similarity between entity nodes in the attack chain is calculated, attack steps are clustered into attack patterns based on the semantic similarity, attack features are extracted from the attack patterns and semantic feature vectors are generated.

[0015] The semantic feature vectors are divided into tactical layer feature vectors, technical layer feature vectors, and behavioral layer feature vectors according to the hierarchical effect of the attack chain, and corresponding hierarchical nodes are generated. The semantic correlation degree between the hierarchical nodes is calculated, and hierarchical nodes with semantic correlation degree greater than a preset correlation threshold are established to form inter-layer relationships. Based on the inter-layer relationships, the hierarchical nodes with correlation relationships are connected in the order of the attack path to form a directed graph structure. According to the in-degree and out-degree values ​​of the hierarchical nodes in the directed graph structure, the hierarchical belonging relationship of the hierarchical nodes is determined. The hierarchical nodes with the same hierarchical belonging relationship are constructed into a knowledge subgraph, and the knowledge subgraphs are connected to form a multi-level knowledge structure.

[0016] The attack path dependencies in the multi-level knowledge structure are added between the corresponding nodes of the initial security threat knowledge graph to obtain a complete security threat knowledge graph.

[0017] High-risk attack paths in the complete security threat knowledge graph are identified using a graph convolutional network. These high-risk attack paths are then matched with the multi-dimensional monitoring data for features. The probability of an attack is calculated based on threat association rules, and potential threat prediction results are generated, including:

[0018] The complete security threat knowledge graph is input into a graph convolutional network, which is then used to aggregate and update the semantic feature vectors. Based on the set of neighboring nodes and the weight matrix, a node representation vector is obtained. Based on the node representation vector, an evaluation index for the node is extracted, and the threat impact of the node is obtained based on the evaluation index.

[0019] The node representation vector and the threat impact are used to calculate the transition probability between adjacent nodes in the attack path. The weighted calculation result of the threat impact and the transition probability is used as the danger score of the attack path. Attack paths with danger scores greater than the path danger threshold are identified as high-risk attack paths.

[0020] The feature vectors of the multi-dimensional monitoring data and the node representation vectors are similar to obtain the feature similarity, and the real-time feature matching probability is obtained based on the feature similarity. Threat rules are extracted from historical attack data, and the prior probability of historical attack paths is calculated according to the matching degree of the threat rules. The real-time feature matching probability and the prior probability are linearly weighted and summed to obtain the attack occurrence probability.

[0021] The threat level is obtained by normalizing and weighting the probability of the attack to the maximum threat impact of the nodes in the high-risk attack path, and then generating a potential threat prediction result of the corresponding level based on the threat level.

[0022] Based on the potential threat prediction results, abnormal behavior is identified by calculating the deviation values ​​of key monitoring indicators. When abnormal behavior is detected, the characteristics of the abnormal behavior are matched with the attack characteristics in the security threat knowledge graph to determine the threat type and threat level, and security threat alarm information is generated, including:

[0023] The predicted threat type and predicted attack probability are obtained from the potential threat prediction results, and key monitoring indicators are selected from the multi-dimensional monitoring data based on the predicted threat type.

[0024] The historical mean and standard deviation of the key monitoring indicator within a specified time window are used as the monitoring baseline; the difference between the current value of the key monitoring indicator and the corresponding historical mean in the monitoring baseline is calculated, and the difference is divided by the corresponding standard deviation to obtain the deviation value. When the deviation value is greater than the anomaly detection threshold, abnormal behavior is marked.

[0025] When abnormal behavior is detected, an abnormal behavior feature vector is extracted from the abnormal behavior data, and an attack feature vector related to the predicted threat type is retrieved from the security threat knowledge graph. The cosine similarity between the abnormal behavior feature vector and the attack feature vector is calculated to obtain the threat feature similarity.

[0026] The attack features in the security threat knowledge graph are matched based on the threat feature similarity, and the threat type corresponding to the attack feature with the highest matching degree is selected; the threat level is obtained based on the deviation value, the threat feature similarity, and the predicted attack probability;

[0027] Based on the threat type, the threat level, and the value assessment results of the currently attacked financial service, a security threat alert is generated.

[0028] Extracting the service fingerprint features of the security threat alert information to configure a dynamic honeypot environment, ensuring the response characteristics of the dynamic honeypot environment are consistent with the characteristics of the currently attacked financial service, and redirecting suspicious traffic to the dynamic honeypot environment through traffic mirroring technology includes:

[0029] Extract service fingerprint features of the currently attacked financial service from security threat alert information to generate a target service feature set; calculate the mean and variance of the service response time series in the target service feature set to generate a latency baseline parameter; extract interaction protocol parameters from the target service feature set to generate an interaction rule set; configure a dynamic honeypot environment according to the latency baseline parameter and the interaction rule set to ensure that the response features of the dynamic honeypot environment are consistent with the fingerprint features of the currently attacked financial service.

[0030] Based on the threat type, abnormal behavior features are extracted from the security threat alarm information. The deviation ratio between the request frequency of each data stream in the current network traffic and the frequency baseline in the abnormal behavior features is calculated. The request URL is compared with the access path features in the abnormal behavior features to calculate the path difference. The deviation ratio and the path difference are weighted to obtain the traffic suspiciousness score.

[0031] When the traffic suspicion score is greater than the traffic diversion threshold, a traffic mirroring rule is configured on the upstream gateway node of the currently attacked financial service; traffic that meets the traffic mirroring rule is diverted to the dynamic honeypot environment through transparent proxy technology.

[0032] In a dynamic honeypot environment, marker code is implanted to record the attacker's behavioral trajectory. Based on this trajectory, the attacker's intent and technical characteristics are analyzed. Then, based on these intents and characteristics, protection rules for financial transaction scenarios are generated in real time. Deploying these protection rules to the financial business production environment includes:

[0033] In a dynamic honeypot environment, marker code is implanted into the system call layer, memory space, command execution layer, and network communication layer to capture the attacker's operation sequence at each layer and generate an attack behavior trajectory. Operation type distribution features, target resource access features, attack tool features, and attack chain features are extracted from the attack behavior trajectory. These features are then weighted according to their corresponding weight coefficients to obtain an attack intent feature vector. Based on this attack intent feature vector, the attacker's behavior pattern is analyzed, the attacked data is determined, and the attacker's technical means and attack path are identified. The behavior pattern, the attacked data, the technical means, and the attack path are used as attack technique characteristics.

[0034] Based on the attack intent feature vector and the characteristics of the attack techniques, a candidate set of protection rules is generated;

[0035] The rule coverage is obtained by calculating the degree of matching of each rule in the candidate set of protection rules to known attack behaviors; the rule validity is obtained by calculating the false positive probability of the rule; and the rule performance overhead is obtained by calculating the resource consumption of the rule execution. The rule score is obtained by weighting the rule coverage, the rule validity, and the rule performance overhead. Protection rules are selected according to the rule score to generate the final protection rule set. The final protection rule set is deployed to the financial business production environment.

[0036] A second aspect of this invention provides a cloud-native application security protection and monitoring system for fintech, comprising:

[0037] The first unit is used to obtain multi-dimensional monitoring data from fintech cloud-native applications;

[0038] The second unit is used to establish an initial security threat knowledge graph based on the multi-dimensional monitoring data, perform semantic modeling of historical security events according to the attack chain, establish a multi-level knowledge structure based on semantic correlation, and obtain a complete security threat knowledge graph based on the multi-level knowledge structure.

[0039] The third unit is used to identify high-risk attack paths in the complete security threat knowledge graph through graph convolutional networks, perform feature matching between the high-risk attack paths and the multi-dimensional monitoring data, calculate the probability of attack occurrence based on threat association rules, and generate potential threat prediction results.

[0040] The fourth unit is used to identify abnormal behavior based on the prediction results of potential threats by calculating the deviation value of key monitoring indicators. When abnormal behavior is detected, the abnormal behavior features are matched with the attack features in the security threat knowledge graph to determine the threat type and threat level, and generate security threat alarm information.

[0041] The fifth unit is used to extract the service fingerprint features of the security threat alarm information to configure a dynamic honeypot environment. The response features of the dynamic honeypot environment are kept consistent with the features of the financial service currently under attack. Suspicious traffic is diverted to the dynamic honeypot environment through traffic mirroring technology. Marking code is implanted in the dynamic honeypot environment to record the attacker's behavior trajectory. The attacker's attack intent and technical characteristics are analyzed based on the behavior trajectory. Based on the attack intent and technical characteristics, protection rules for financial transaction scenarios are generated in real time, and the protection rules are deployed to the financial business production environment.

[0042] A third aspect of the present invention,

[0043] An electronic device is provided, comprising:

[0044] processor;

[0045] Memory used to store processor-executable instructions;

[0046] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0047] Fourth aspect of the embodiments of the present invention,

[0048] A computer-readable storage medium is provided, having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0049] The beneficial effects of this application are as follows:

[0050] By constructing a security threat knowledge graph and applying graph convolutional network technology, we have achieved accurate identification of high-risk attack paths and early prediction of potential threats, which has greatly improved the efficiency and accuracy of security risk discovery in the fintech environment and transformed security protection from passive response to proactive prevention.

[0051] By leveraging dynamic honeypot technology combined with traffic mirroring, we have successfully achieved in-depth analysis of attacker behavior. This not only identifies threats but also understands attack intentions and technical characteristics, thereby generating more targeted protection rules and effectively improving security protection capabilities in financial transaction scenarios.

[0052] By combining multi-dimensional monitoring data analysis with abnormal behavior identification, a complete security protection closed loop has been established, which automates the entire process from threat discovery, analysis, and verification to protection rule generation and deployment. This significantly reduces security risks in the fintech cloud-native environment while alleviating the workload of security operations personnel. Attached Figure Description

[0053] Figure 1 This is a flowchart illustrating the cloud-native application security protection and monitoring method for financial technology according to an embodiment of the present invention.

[0054] Figure 2 This is a schematic diagram illustrating the comparative analysis of node degree distribution;

[0055] Figure 3 This diagram illustrates a comparison of the accuracy of attack traffic identification. Detailed Implementation

[0056] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0057] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0058] Figure 1 This is a flowchart illustrating the cloud-native application security protection and monitoring method for financial technology according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0059] Obtain multi-dimensional monitoring data from fintech cloud-native applications;

[0060] An initial security threat knowledge graph is established based on the multi-dimensional monitoring data. Historical security events are semantically modeled according to the attack chain. A multi-level knowledge structure is established based on semantic correlation. A complete security threat knowledge graph is obtained based on the multi-level knowledge structure.

[0061] High-risk attack paths in the complete security threat knowledge graph are identified by graph convolutional networks. The high-risk attack paths are then matched with the multi-dimensional monitoring data. The probability of an attack is calculated based on threat association rules, and potential threat prediction results are generated.

[0062] Based on the potential threat prediction results, abnormal behavior is identified by calculating the deviation value of key monitoring indicators. When abnormal behavior is detected, the abnormal behavior characteristics are matched with the attack characteristics in the security threat knowledge graph to determine the threat type and threat level, and generate security threat alarm information.

[0063] The service fingerprint features of the security threat alarm information are extracted to configure a dynamic honeypot environment. The response characteristics of the dynamic honeypot environment are made consistent with the characteristics of the financial service currently under attack. Suspicious traffic is diverted to the dynamic honeypot environment through traffic mirroring technology. Marking code is implanted in the dynamic honeypot environment to record the attacker's behavior trajectory. The attacker's attack intent and technical characteristics are analyzed based on the behavior trajectory. Based on the attack intent and technical characteristics, protection rules for financial transaction scenarios are generated in real time and deployed to the financial business production environment.

[0064] In one optional implementation, an initial security threat knowledge graph is established based on the multi-dimensional monitoring data. Historical security events are semantically modeled according to attack chains, and a multi-level knowledge structure is established based on semantic correlation. The complete security threat knowledge graph obtained based on the multi-level knowledge structure includes:

[0065] Entity nodes are generated based on the multi-dimensional monitoring data, and interaction relationships are extracted based on the interaction information between the entity nodes. The entity nodes and the interaction relationships are combined to form an initial security threat knowledge graph.

[0066] Based on the initial security threat knowledge graph, attack chains in historical security events are extracted, semantic similarity between entity nodes in the attack chain is calculated, attack steps are clustered into attack patterns based on the semantic similarity, attack features are extracted from the attack patterns and semantic feature vectors are generated.

[0067] The semantic feature vectors are divided into tactical layer feature vectors, technical layer feature vectors, and behavioral layer feature vectors according to the hierarchical effect of the attack chain, and corresponding hierarchical nodes are generated. The semantic correlation degree between the hierarchical nodes is calculated, and hierarchical nodes with semantic correlation degree greater than a preset correlation threshold are established to form inter-layer relationships. Based on the inter-layer relationships, the hierarchical nodes with correlation relationships are connected in the order of the attack path to form a directed graph structure. According to the in-degree and out-degree values ​​of the hierarchical nodes in the directed graph structure, the hierarchical belonging relationship of the hierarchical nodes is determined. The hierarchical nodes with the same hierarchical belonging relationship are constructed into a knowledge subgraph, and the knowledge subgraphs are connected to form a multi-level knowledge structure.

[0068] The attack path dependencies in the multi-level knowledge structure are added between the corresponding nodes of the initial security threat knowledge graph to obtain a complete security threat knowledge graph.

[0069] In the initial security threat knowledge graph generation phase, entity information is extracted from multi-dimensional monitoring data to serve as nodes in the graph. This monitoring data includes network traffic logs, user behavior logs, and system resource usage. Taking network traffic logs as an example, information such as the source IP address 192.168.1.100, the target IP address 10.0.0.5, the TCP protocol used, and port number 443 can be identified as entity nodes. Simultaneously, the interaction information between these entity nodes is analyzed. For example, the relationship of "source IP sending data packets to target IP" is extracted from network connection records and represented as an edge pointing from the source IP node to the target IP node, with edge attributes including sending time and data size. In this way, an initial security threat knowledge graph is established, containing a large number of entity nodes and their interaction relationships.

[0070] Based on the initial security threat knowledge graph, the following attack chain is extracted from ransomware attack incidents: Attacker sends malicious attachments via phishing emails (Node A) → User downloads and executes the attachment (Node B) → Malicious program establishes remote connection (Node C) → Downloads encryption component (Node D) → Encrypts user files (Node E) → Demands ransom (Node F). The semantic similarity between entity nodes in these attack chains is calculated; for example, comparing the similarity between "sending malicious attachments via phishing emails" and "sending malicious links via instant messaging software" in different attack incidents. If the similarity reaches 0.85 (assuming a threshold of 0.8), these two attack steps are clustered into the same attack pattern, "social engineering attack." From these attack patterns, keywords, behavioral features, etc., are extracted to generate semantic feature vectors. For example, for the "social engineering attack" pattern, the extracted features include keywords such as "clickbait," "disguise," "attachment," and "link," along with their weights.

[0071] The generated semantic feature vectors are divided into three levels according to the hierarchy of the attack chain: tactical layer, technical layer, and behavioral layer. For example, "gaining system access privileges" belongs to the tactical layer feature vector; "exploiting system vulnerabilities" belongs to the technical layer feature vector; and "executing specific shellcode" belongs to the behavioral layer feature vector. Corresponding nodes are generated for each level, and the semantic correlation between these level nodes is calculated. Assuming the semantic correlation between "social engineering attack" (technical layer) and "initial access" (tactical layer) is 0.92, exceeding the preset correlation threshold of 0.7, an inter-layer relationship is established between these two level nodes. Based on these inter-layer relationships, the level nodes with correlations are connected in the order of the attack path to form a directed graph structure.

[0072] In a directed graph structure, the in-degree and out-degree values ​​of each node are calculated. For example, the "Initial Access" node has an in-degree of 0 and an out-degree of 3; the "Privilege Elevation" node has an in-degree of 2 and an out-degree of 2. Based on these degree values, the hierarchical affiliation of the nodes is determined, with nodes having smaller in-degree values ​​typically located at higher levels. Nodes with the same hierarchical affiliation are then grouped into knowledge subgraphs; for example, all tactical-level nodes form one subgraph, and all technical-level nodes form another. Subsequently, these knowledge subgraphs are connected to form a multi-level knowledge structure.

[0073] The attack path dependencies from the multi-level knowledge structure are then added to the initial security threat knowledge graph. For example, the initial graph shows a relationship where IP_A sends data packets to IP_B, but lacks the attack intent behind this behavior. Through the multi-level knowledge structure, this behavior is identified as conforming to the characteristics of "remote service scanning," belonging to a "reconnaissance" tactic. Therefore, this semantic relationship is added between the two IP nodes. This results in a complete security threat knowledge graph containing entity nodes, interaction relationships, and attack semantics. This graph not only displays the state and behavior of entities in the network but also reveals potential attack paths and threat patterns, providing a rich knowledge foundation for security analysis and threat detection.

[0074] The security threat knowledge graph constructed using this method can effectively integrate multi-dimensional security data, perform semantic understanding of attack behaviors, and establish a multi-level knowledge structure, enabling security analysts to have a more comprehensive understanding of cybersecurity threats and improve threat detection and response capabilities.

[0075] Figure 2This diagram illustrates a comparative analysis of node degree distribution. It shows the results of comparing the node degree distribution of this invention with traditional knowledge graph methods and basic graph structure methods, verifying the significant advantages of this invention in constructing multi-level knowledge structures. As can be seen from the diagram, this invention achieves a node coverage rate of 92.3% at the tactical layer, 88.7% at the technical layer, and a high coverage rate of 94.1% at the behavioral layer, all significantly better than the 76.4%, 71.2%, and 68.9% of traditional knowledge graph methods and the 58.1%, 52.6%, and 49.3% of basic graph structure methods, respectively. Particularly noteworthy is the outstanding performance of this invention in identifying associated nodes, achieving a coverage rate of 89.5%, compared to only 65.3% for traditional methods and a mere 41.8% for basic methods. This fully demonstrates the effectiveness of this invention in establishing inter-layer relationships based on semantic association. Furthermore, the proportion of isolated nodes in this invention is only 8.2%, far lower than the 28.7% of traditional methods and 45.2% of basic methods, indicating that this invention can better discover potential relationships between nodes and construct a more complete and coherent knowledge graph structure. This comparative result demonstrates the technical innovation and practicality of the present invention in semantic feature vector layering, hierarchical node correlation calculation, and multi-level knowledge structure construction, providing a more reliable knowledge foundation for subsequent threat identification and attack path analysis.

[0076] In one optional implementation, high-risk attack paths in the complete security threat knowledge graph are identified using a graph convolutional network. These high-risk attack paths are then matched with the multi-dimensional monitoring data for features. The probability of an attack is calculated based on threat association rules, and potential threat prediction results are generated, including:

[0077] The complete security threat knowledge graph is input into a graph convolutional network, which is then used to aggregate and update the semantic feature vectors. Based on the set of neighboring nodes and the weight matrix, a node representation vector is obtained. Based on the node representation vector, an evaluation index for the node is extracted, and the threat impact of the node is obtained based on the evaluation index.

[0078] The node representation vector and the threat impact are used to calculate the transition probability between adjacent nodes in the attack path. The weighted calculation result of the threat impact and the transition probability is used as the danger score of the attack path. Attack paths with danger scores greater than the path danger threshold are identified as high-risk attack paths.

[0079] The feature vectors of the multi-dimensional monitoring data and the node representation vectors are similar to obtain the feature similarity, and the real-time feature matching probability is obtained based on the feature similarity. Threat rules are extracted from historical attack data, and the prior probability of historical attack paths is calculated according to the matching degree of the threat rules. The real-time feature matching probability and the prior probability are linearly weighted and summed to obtain the attack occurrence probability.

[0080] The threat level is obtained by normalizing and weighting the probability of the attack to the maximum threat impact of the nodes in the high-risk attack path, and then generating a potential threat prediction result of the corresponding level based on the threat level.

[0081] A complete security threat knowledge graph contains various threat nodes and their relationships. Graph convolutional networks aggregate and update the semantic feature vectors of nodes. Specifically, this process considers the set of first-order neighbor nodes for each node and uses a pre-defined weight matrix to weight and aggregate the features of these neighbor nodes, thereby obtaining the updated node representation vector. For example, for a vulnerable node in the network, its representation vector is obtained by aggregating the features of its directly connected neighbor nodes, such as attack method nodes and affected asset nodes.

[0082] After the node representation vectors are generated, evaluation metrics for the nodes are extracted, including node centrality, connectivity, and importance within the knowledge graph. Based on these metrics, the threat impact of each node is calculated. For example, core server nodes with high connectivity and in critical positions are assigned a higher weight for their threat impact, such as an impact score of 0.85; while the threat impact of ordinary terminal devices is only 0.45.

[0083] The transition probability represents the likelihood of an attacker moving from the current node to the next, taking into account the strength of the association between nodes and the level of security protection. Threat impact and transition probability are weighted together, for example, with a threat impact weight of 0.6 and a transition probability weight of 0.4. The resulting weighted score is used as the attack path's hazard score. A path hazard threshold is set, for example, 0.75. When the hazard score of an attack path exceeds this threshold, the path is identified as a high-risk attack path.

[0084] The system collects multi-dimensional monitoring data, including network traffic, system logs, and user behavior. This monitoring data is processed into feature vectors, which are then compared with node representation vectors to calculate feature similarity. For example, if the feature vector of an abnormal network connection has a similarity of 0.82 with the representation vector of a "network scan" node, it indicates a high degree of match between the current monitoring data and this attack pattern. Based on feature similarity, a real-time feature matching probability is calculated; for example, 0.78 represents the degree of match between the currently monitored behavior and a specific node in a high-risk attack path.

[0085] Historical attack events are clustered, grouping those with similarity exceeding a clustering threshold into the same category. Common behavioral patterns are extracted for each category, including the temporal relationship of behavioral sequences, the numerical range of feature values, and the resource type of the affected object. These behavioral patterns are then translated into a rule description language, setting trigger conditions, matching thresholds, and response actions to generate threat rules. These rules describe the characteristic combinations and sequences of specific attack patterns. Based on the degree of matching between current monitoring data and these threat rules, the prior probability of historical attack paths is calculated. For example, if the currently monitored network behavior matches a 70% probability with a previously recorded DDoS attack precursor pattern, the corresponding prior probability is 0.65.

[0086] The real-time feature matching probability and the prior probability are linearly weighted and summed. For example, the real-time matching probability is given a weight of 0.7 and the prior probability is given a weight of 0.3. Finally, the comprehensive attack probability is obtained, for example, 0.74.

[0087] The attack probability and the maximum threat impact of nodes in high-risk attack paths are normalized and weighted, with the sum calculated as follows: for example, the attack probability is weighted at 0.65, and the maximum threat impact at 0.35. The result is used as the threat level. Threat levels are divided into several categories, such as extremely high risk (0.9-1.0), high risk (0.7-0.9), medium risk (0.5-0.7), low risk (0.3-0.5), and negligible risk (0-0.3). Based on the calculated threat level, corresponding potential threat prediction results are generated.

[0088] In a specific instance, a high-risk attack path from an internet access point to an internal database server was identified, with a risk score of 0.82. Current monitoring data shows abnormal port scanning behavior, with a feature similarity of 0.88 to the starting node of this path, corresponding to a real-time feature matching probability of 0.85. Historical data indicates that the prior probability of similar behavior being associated with data theft attacks is 0.70. The calculated attack probability is 0.81, which, after being weighted and summed with the threat impact score of the database server node in the path (0.90), yields a threat level of 0.84, corresponding to a "high-risk" level. The generated prediction is: "A high-risk potential data theft attack has been detected, targeting the core database server. It is recommended to immediately isolate suspicious network traffic and strengthen access control for critical assets."

[0089] The above methods can promptly identify high-risk attack paths in the network and predict potential security threats based on multi-dimensional monitoring data, providing security operations and maintenance personnel with accurate early warning information and protection suggestions.

[0090] In one optional implementation, based on the potential threat prediction results, abnormal behavior is identified by calculating the deviation value of key monitoring indicators. When abnormal behavior is detected, the characteristics of the abnormal behavior are matched with the attack characteristics in the security threat knowledge graph to determine the threat type and threat level, and security threat alarm information is generated, including:

[0091] The predicted threat type and predicted attack probability are obtained from the potential threat prediction results, and key monitoring indicators are selected from the multi-dimensional monitoring data based on the predicted threat type.

[0092] The historical mean and standard deviation of the key monitoring indicator within a specified time window are used as the monitoring baseline; the difference between the current value of the key monitoring indicator and the corresponding historical mean in the monitoring baseline is calculated, and the difference is divided by the corresponding standard deviation to obtain the deviation value. When the deviation value is greater than the anomaly detection threshold, abnormal behavior is marked.

[0093] When abnormal behavior is detected, an abnormal behavior feature vector is extracted from the abnormal behavior data, and an attack feature vector related to the predicted threat type is retrieved from the security threat knowledge graph. The cosine similarity between the abnormal behavior feature vector and the attack feature vector is calculated to obtain the threat feature similarity.

[0094] The attack features in the security threat knowledge graph are matched based on the threat feature similarity, and the threat type corresponding to the attack feature with the highest matching degree is selected; the threat level is obtained based on the deviation value, the threat feature similarity, and the predicted attack probability;

[0095] Based on the threat type, the threat level, and the value assessment results of the currently attacked financial service, a security threat alert is generated.

[0096] For a certain online payment service, an "SQL injection attack" threat was predicted, with a predicted attack probability of 0.78. Based on this predicted threat type, key monitoring indicators related to SQL injection attacks were selected from multi-dimensional monitoring data, including database query frequency, the proportion of abnormal SQL statements, and database response time. This selection mechanism ensures that monitoring resources are concentrated on the system components with the highest probability of attack.

[0097] For the database query frequency metric, its historical mean (e.g., 200 queries per 10 minutes) and standard deviation (e.g., 50 queries per 10 minutes) are calculated for every 10-minute time window over the past 7 days. The establishment of the monitoring baseline takes into account the daily fluctuations in business operations, including differences between weekdays and weekends, and differences between peak and off-peak transaction periods, making anomaly detection more accurate.

[0098] If the number of queries reaches 350 within the current 10 minutes, the deviation value is calculated as (350-200) / 50=3. The preset anomaly detection threshold is 2.5. Since the deviation value of 3 is greater than the threshold of 2.5, it is marked as abnormal behavior. This statistically based anomaly detection method effectively filters out normal business fluctuations while simultaneously capturing potential security threats.

[0099] For SQL injection attacks, the feature vector contains multi-dimensional information such as the characteristic patterns of the abnormal SQL statements, the geographical distribution of accessing IP addresses, and the distribution of request times. For example, the feature vector may contain feature values ​​such as "number of consecutively failed database connections = 35", "proportion of queries containing UNION SELECT statements = 0.4", and "proportion of requests from abnormal geographical locations = 0.6".

[0100] For SQL injection threat types, feature vectors of multiple known SQL injection attack patterns were retrieved, such as "blind injection attack," "join query injection," and "error injection." The feature vector of each attack pattern contains typical characteristic values ​​of that attack type. For example, the feature vector of "blind injection attack" contains characteristic values ​​such as "number of consecutive failed database connections > 30" and "proportion of queries containing conditional statements > 0.3."

[0101] The current abnormal behavior has a similarity of 0.85 with "blind SQL injection," 0.62 with "join query injection," and 0.43 with "error injection." The threat type corresponding to the attack feature with the highest similarity is selected; in this example, it is determined to be "SQL blind SQL injection attack."

[0102] The determination of threat level takes into account multiple factors: a deviation value of 3.0 indicates a high degree of abnormality; a threat feature similarity of 0.85 indicates a high degree of matching; and a predicted attack probability of 0.78 indicates a high threat level. These values ​​are input into the threat level assessment model, which is trained based on historical security incident data, and the final threat level is determined to be "high risk" (e.g., in the four-level classification of "low risk", "medium risk", "high risk" and "severe").

[0103] For the SQL blind injection attack detected in the online payment service, the estimated scale of user funds affected is 5 million yuan. An alarm message is generated: "A high-risk SQL blind injection attack threat has been detected, targeting the core payment database, affecting transaction amount of approximately 5 million yuan, with a similarity of 85%. It is recommended to immediately block the source IP and initiate the emergency response process."

[0104] This security threat alert is pushed to security analysts through the security operations center, simultaneously triggering automatic defense mechanisms such as temporarily restricting access permissions for suspicious IP addresses and enhancing security monitoring of the target database. The entire process, from anomaly detection to alert generation, takes approximately 30 seconds, significantly improving the speed and accuracy of the financial system's response to security threats.

[0105] In one optional implementation, the service fingerprint features of the security threat alert information are extracted to configure a dynamic honeypot environment. The response characteristics of the dynamic honeypot environment are made consistent with the characteristics of the currently attacked financial service. Suspicious traffic is diverted to the dynamic honeypot environment through traffic mirroring technology, including:

[0106] Extract service fingerprint features of the currently attacked financial service from security threat alert information to generate a target service feature set; calculate the mean and variance of the service response time series in the target service feature set to generate a latency baseline parameter; extract interaction protocol parameters from the target service feature set to generate an interaction rule set; configure a dynamic honeypot environment according to the latency baseline parameter and the interaction rule set to ensure that the response features of the dynamic honeypot environment are consistent with the fingerprint features of the currently attacked financial service.

[0107] Based on the threat type, abnormal behavior features are extracted from the security threat alarm information. The deviation ratio between the request frequency of each data stream in the current network traffic and the frequency baseline in the abnormal behavior features is calculated. The request URL is compared with the access path features in the abnormal behavior features to calculate the path difference. The deviation ratio and the path difference are weighted to obtain the traffic suspiciousness score.

[0108] When the traffic suspicion score is greater than the traffic diversion threshold, a traffic mirroring rule is configured on the upstream gateway node of the currently attacked financial service; traffic that meets the traffic mirroring rule is diverted to the dynamic honeypot environment through transparent proxy technology.

[0109] Upon detecting abnormal access to the online banking login interface, features such as HTTP response headers, server version information, supported cipher suites, cookie structure, and session persistence mechanisms are extracted to form a target service feature set. Specifically, the service feature set includes, but is not limited to: HTTP header fields (Server: Apache / 2.4.6, X-Powered-By: PHP / 7.2.24), TLS version and cipher suites (TLS 1.2, ECDHE-RSA-AES256-GCM-SHA384), and HTML page structure feature values ​​(DOM tree structure hash value), etc.

[0110] The response times of 100 consecutive normal business requests were collected and recorded as a time series [t1, t2, ..., t]. 100 The mean μ of this sequence is calculated to be 89.5 ms, and the variance σ is calculated to be σ. 2 =12.3ms 2 Generate time delay baseline parameters {μ, σ}. 2 These parameters will be used to configure the honeypot environment so that its response time characteristics are consistent with those of a real service.

[0111] For the online banking login function, the interaction process of HTTP requests and responses was analyzed, and key protocol parameters were extracted, including: request method (POST / login.php), request header requirements (Content-Type: application / json), authentication mechanism (JWT token structure), response status code rules (200 for successful login, 400 for incorrect parameters, and 401 for authentication failure), etc., forming a complete set of interaction rules.

[0112] On the honeypot deployment server, customized configurations are performed based on the open-source honeypot framework. The service response headers of the honeypot are modified to match the target service. The honeypot response time control parameters are adjusted to ensure the response time conforms to the previously obtained latency baseline parameter distribution. An interaction rule engine is configured to implement request-response logic consistent with the real business system. For example, the login interface response logic is configured to return the appropriate status code and response content according to the behavior pattern of the real system.

[0113] For alerts related to SQL injection attacks, abnormal behavior characteristics were extracted, including: a baseline frequency (normal user access to the login interface is 2 times / minute) and abnormal request characteristics (including SQL injection features such as 'OR 1=1'). Monitoring real-time traffic revealed that IP address 192.168.1.101 initiated 35 login attempts in the past minute, with a deviation ratio of (35-2) / 2 = 16.5, indicating that the request frequency of this IP is significantly higher than normal.

[0114] Extract abnormal access path characteristics from the alarm information, such as sensitive paths that attackers often try to access, such as " / admin / manage.php" and " / config / db.php". Analyze the current request URL " / login.php?debug=true&access=admin" and calculate its similarity with the known list of sensitive paths. Use a path string matching algorithm to obtain a path difference score of 0.65 (the difference score ranges from 0 to 1, with a larger value indicating greater suspicion).

[0115] Assigning a weight of 0.7 to the deviation ratio and a weight of 0.3 to the path difference, the calculated suspiciousness score is 16.5 × 0.7 + 0.65 × 0.3 = 11.75. The preset traffic redirection threshold is 10. Since 11.75 > 10, this traffic is determined to be highly suspicious.

[0116] Configure a traffic mirroring rule on the gateway device to mirror all HTTP requests originating from IP 192.168.1.101 and destined for the login service. After the rule is configured, all requests from this IP will be copied and sent to the honeypot environment, while the original traffic will still flow normally to the real business system.

[0117] In the network architecture, a transparent proxy server is deployed, configured with iptables rules to redirect mirrored traffic to the honeypot server (IP address 10.10.10.5, port 8080). The proxy server modifies the destination address information of data packets, making it impossible for attackers to detect that traffic has been redirected to the honeypot environment. Simultaneously, the honeypot system records all attacker operations, including request content, input parameters, and attack paths, providing detailed evidence for subsequent security analysis.

[0118] Figure 3 This diagram illustrates a comparative analysis of attack traffic identification accuracy. It shows the results of comparing the accuracy of this invention with four baseline methods—traditional IDS systems, machine learning detection, rule matching detection, and statistical anomaly detection—at different suspicion thresholds. This fully verifies the technical advantages of this invention in dynamic honeypot configuration and intelligent traffic analysis. The diagram clearly shows that the accuracy of this invention reaches a peak of 97.1% at a threshold of 6, significantly outperforming the highest accuracy of 83.4% for traditional IDS systems, 89.1% for machine learning detection, 80.1% for rule matching detection, and 79.7% for statistical anomaly detection. Particularly noteworthy is that this invention maintains a relatively stable high accuracy across the entire threshold range. Even in the extreme cases of thresholds 1 and 10, the accuracy still reaches 85.2% and 92.1%, respectively, while the accuracy of other methods fluctuates significantly and is generally lower. This comparison fully demonstrates the technical innovation of this invention, which utilizes service fingerprint features to configure a dynamic honeypot environment, a traffic suspicion scoring mechanism based on deviation ratio and path difference for weighted calculation, and transparent proxy technology to achieve traffic redirection. This invention not only significantly surpasses existing methods in terms of identification accuracy, but more importantly, it demonstrates stability and robustness under different threat intensities, providing a more reliable and efficient technical solution for the security protection of financial systems. It fully proves the practical value and technological advancement of the multi-level threat identification and dynamic honeypot linkage mechanism.

[0119] In one optional implementation, marker code is implanted in the dynamic honeypot environment to record the attacker's behavioral trajectory. The attacker's intent and technical characteristics are analyzed based on the behavioral trajectory. Based on the intent and technical characteristics, protection rules for financial transaction scenarios are generated in real time. Deploying these protection rules to the financial business production environment includes:

[0120] In a dynamic honeypot environment, marker code is implanted into the system call layer, memory space, command execution layer, and network communication layer to capture the attacker's operation sequence at each layer and generate an attack behavior trajectory. Operation type distribution features, target resource access features, attack tool features, and attack chain features are extracted from the attack behavior trajectory. These features are then weighted according to their corresponding weight coefficients to obtain an attack intent feature vector. Based on this attack intent feature vector, the attacker's behavior pattern is analyzed, the attacked data is determined, and the attacker's technical means and attack path are identified. The behavior pattern, the attacked data, the technical means, and the attack path are used as attack technique characteristics.

[0121] Based on the attack intent feature vector and the characteristics of the attack techniques, a candidate set of protection rules is generated;

[0122] The rule coverage is obtained by calculating the degree of matching of each rule in the candidate set of protection rules to known attack behaviors; the rule validity is obtained by calculating the false positive probability of the rule; and the rule performance overhead is obtained by calculating the resource consumption of the rule execution. The rule score is obtained by weighting the rule coverage, the rule validity, and the rule performance overhead. Protection rules are selected according to the rule score to generate the final protection rule set. The final protection rule set is deployed to the financial business production environment.

[0123] A dynamic honeypot environment refers to a virtual environment that simulates a real financial business system, including common financial transaction system components such as online banking, payment gateways, and account management systems. To capture the attacker's comprehensive behavior, this invention implants marker code at the system call layer, enabling the interception of system calls through hooking techniques. For example, when an attacker attempts to access the file system, functions such as `open()`, `read()`, and `write()` are hooked, recording the accessed file path, access time, and operation type. At the memory space level, the marker code monitors stack changes through memory scanning techniques. For instance, when an attacker performs a buffer overflow attack, abnormal write operations in the memory address range 0x7ffe8c3b1000 to 0x7ffe8c3b2000 are recorded, including the content and size of the written data.

[0124] At the command execution layer, the tagging code records all executed commands using shell command interception technology. For example, when an attacker executes "cat / etc / passwd", the complete command content, execution time, and environment variables are recorded. At the network communication layer, the tagging code captures all network packets using network traffic mirroring technology, recording the source IP address, destination IP address, port number, protocol type, and packet content. For example, it records a POST request sent by an attacker from IP address 192.168.1.X to port 8080 of 192.168.2.X and its payload content.

[0125] These multi-layered tagging codes work together to integrate the captured operation sequences in chronological order, forming a complete attack behavior trajectory. A typical attack behavior trajectory includes: the attacker first logs into the system with a weak password, executes privilege escalation commands, accesses the database configuration file, modifies the transaction verification logic, and finally attempts to initiate a forged transaction.

[0126] Multidimensional features are extracted from attack behavior trajectories for analysis. Operation type distribution features are obtained by statistically analyzing the frequency and temporal relationships of different operation types; for example, file operations account for 25%, network operations for 40%, and command execution for 35%. Target resource access features record the type, path, and access method of the accessed resources, with a focus on access to transaction databases, configuration files, and key storage. Attack tool features are obtained by identifying the signatures and usage patterns of specific tools; for example, identifying characteristic code snippets using specific penetration testing tools. Attack chain features are constructed by analyzing the temporal and causal relationships between operations; for example, identifying a typical "reconnaissance-penetration-privilege escalation-lateral movement-data acquisition" attack chain.

[0127] These features are combined according to preset weights to form an attack intent feature vector. For example, high-frequency access to financial databases has a weight of 0.4, modification of configuration files has a weight of 0.3, network communication features have a weight of 0.2, and command execution features have a weight of 0.1. Through vector analysis, attacker behavior patterns can be identified, such as determining that the attacker mainly targets the transaction verification logic, intending to bypass transaction limit checks; identifying the attacked data as the limit configuration of the transaction verification table; and identifying the attacker's techniques as SQL injection combined with privilege escalation, with the attack path being penetration through the network entry server followed by lateral movement to the database server.

[0128] For identified SQL injection attacks, rules are generated such as "intercept database requests containing UNION SELECT statements that access the transaction verification table"; for configuration file modifications, rules are generated such as "prohibit unauthorized processes from modifying the transaction limit configuration file"; for abnormal network connections, rules are generated such as "restrict the database server from connection requests to unauthorized external IPs".

[0129] To evaluate rule quality, rule coverage is calculated, which is the proportion of known attack behaviors that a rule can cover, such as a rule covering 80% of SQL injection attacks. Rule effectiveness is calculated by verifying the false positive rate in a test environment, such as a rule with a false positive rate of 0.1% under normal business processes. Rule performance overhead is also calculated, such as a rule increasing CPU usage by 2% and memory usage by 5MB at 1000 transactions per second. These three metrics are weighted at 0.5, 0.3, and 0.2 respectively to obtain the final rule score.

[0130] Based on the rule scores, the rules with the highest scores are selected to form the final protection rule set. These rules are then automatically deployed to the corresponding components in the financial business production environment via the configuration management system. For example, SQL injection protection rules are deployed to the database firewall, abnormal connection rules to network boundary devices, and configuration file protection rules to host security components. After deployment, the execution and effectiveness of the rules are continuously monitored, and optimizations are made based on feedback.

[0131] This method enables financial institutions to generate targeted protective measures in real time based on attackers' behavior in honeypot environments, and deploy them in advance to the production environment, effectively preventing similar attacks from threatening actual business operations.

[0132] This invention provides a cloud-native application security protection and monitoring system for fintech, comprising:

[0133] The first unit is used to obtain multi-dimensional monitoring data from fintech cloud-native applications;

[0134] The second unit is used to establish an initial security threat knowledge graph based on the multi-dimensional monitoring data, perform semantic modeling of historical security events according to the attack chain, establish a multi-level knowledge structure based on semantic correlation, and obtain a complete security threat knowledge graph based on the multi-level knowledge structure.

[0135] The third unit is used to identify high-risk attack paths in the complete security threat knowledge graph through graph convolutional networks, perform feature matching between the high-risk attack paths and the multi-dimensional monitoring data, calculate the probability of attack occurrence based on threat association rules, and generate potential threat prediction results.

[0136] The fourth unit is used to identify abnormal behavior based on the prediction results of potential threats by calculating the deviation value of key monitoring indicators. When abnormal behavior is detected, the abnormal behavior features are matched with the attack features in the security threat knowledge graph to determine the threat type and threat level, and generate security threat alarm information.

[0137] The fifth unit is used to extract the service fingerprint features of the security threat alarm information to configure a dynamic honeypot environment. The response features of the dynamic honeypot environment are kept consistent with the features of the financial service currently under attack. Suspicious traffic is diverted to the dynamic honeypot environment through traffic mirroring technology. Marking code is implanted in the dynamic honeypot environment to record the attacker's behavior trajectory. The attacker's attack intent and technical characteristics are analyzed based on the behavior trajectory. Based on the attack intent and technical characteristics, protection rules for financial transaction scenarios are generated in real time, and the protection rules are deployed to the financial business production environment.

[0138] A third aspect of the present invention provides an electronic device, comprising:

[0139] processor;

[0140] Memory used to store processor-executable instructions;

[0141] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0142] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0143] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0144] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for security protection and monitoring of cloud-native applications for financial technology, characterized in that, The method comprises the following steps: obtaining multi-dimensional monitoring data from a financial technology cloud native application; establishing an initial security threat knowledge graph based on the multi-dimensional monitoring data, semantically modeling historical security events according to attack chain links, establishing a multi-level knowledge structure based on semantic correlation, and obtaining a complete security threat knowledge graph based on the multi-level knowledge structure, including: generating entity nodes based on the multi-dimensional monitoring data, extracting interaction relationships based on interaction information between the entity nodes, and forming an initial security threat knowledge graph by combining the entity nodes and the interaction relationships; based on the initial security threat knowledge graph, extracting attack chain links in historical security events, calculating semantic similarity between entity nodes in the attack chain links, clustering attack steps based on the semantic similarity to form attack patterns, extracting attack features from the attack patterns and generating semantic feature vectors; dividing the semantic feature vectors into tactical layer feature vectors, technical layer feature vectors and behavior layer feature vectors according to the function levels of the attack chain links and generating corresponding hierarchical nodes, calculating semantic correlation between the hierarchical nodes, and establishing inter-layer relationships between hierarchical nodes with semantic correlation greater than a preset correlation threshold; based on the inter-layer relationships, connecting hierarchical nodes with associated relationships in order according to attack paths to form a directed graph structure, determining the hierarchical attribution relationship of the hierarchical nodes according to the in-degree and out-degree values of the hierarchical nodes in the directed graph structure, constructing knowledge sub-graphs by connecting hierarchical nodes with the same hierarchical attribution relationship, and connecting knowledge sub-graphs to form a multi-level knowledge structure; supplementing attack path dependency relationships in the multi-level knowledge structure to corresponding nodes in the initial security threat knowledge graph to obtain a complete security threat knowledge graph; identifying high-risk attack paths in the complete security threat knowledge graph through a graph convolution network, performing feature matching between the high-risk attack paths and the multi-dimensional monitoring data, calculating attack occurrence probability according to threat correlation rules, and generating potential threat prediction results; based on the potential threat prediction results, identifying abnormal behaviors by calculating the deviation value of key monitoring indicators, when abnormal behaviors are detected, performing similarity matching between the abnormal behavior features and the attack features in the security threat knowledge graph to determine the threat type and threat level, and generating security threat alarm information; extracting service fingerprint features of the security threat alarm information to configure a dynamic honeypot environment, keeping the response features of the dynamic honeypot environment consistent with the features of the current attacked financial service, diverting suspicious traffic to the dynamic honeypot environment through traffic mirroring technology, implanting a marker code in the dynamic honeypot environment to record the behavior trajectory of the attacker, analyzing the attack intention and technical characteristics of the attacker according to the behavior trajectory, generating real-time protection rules for the financial transaction scene according to the attack intention and technical characteristics, and deploying the protection rules to the financial business production environment.

2. The method of claim 1, wherein, The high-risk attack path in the complete security threat knowledge graph is identified through a graph convolution network, feature matching is performed between the high-risk attack path and the multi-dimensional monitoring data, an attack occurrence probability is calculated according to a threat correlation rule, and a potential threat prediction result is generated, including: The complete security threat knowledge graph is input into a graph convolution network, the semantic feature vector is aggregated and updated by using the graph convolution network, a node representation vector is obtained based on a neighbor node set of a node and a weight matrix, and an evaluation index of the node is extracted based on the node representation vector; a threat influence degree of the node is obtained based on the evaluation index; A transition probability between adjacent nodes in an attack path is calculated by using the node representation vector and the threat influence degree, a danger degree score of the attack path is obtained by weighting a calculation result of the threat influence degree and the transition probability, and an attack path with a danger degree score greater than a path danger degree threshold is determined as a high-risk attack path; A feature vector of the multi-dimensional monitoring data is subjected to similarity calculation with the node representation vector to obtain a feature similarity, a real-time feature matching probability is obtained based on the feature similarity, threat rules are extracted from historical attack data, a prior probability of a historical attack path is calculated according to a matching degree of the threat rules, and a linear weighted sum of the real-time feature matching probability and the prior probability is obtained to obtain an attack occurrence probability; A threat level is obtained by normalizing and weighting a sum of the attack occurrence probability and a maximum threat influence degree of a node in the high-risk attack path, and a potential threat prediction result of a corresponding level is generated based on the threat level.

3. The method of claim 1, wherein, Based on the potential threat prediction result, an abnormal behavior is identified by calculating a deviation value of a key monitoring indicator, when the abnormal behavior is detected, similarity matching is performed between an abnormal behavior feature and an attack feature in the security threat knowledge graph to determine a threat type and a threat level, and security threat alarm information is generated, including: A predicted threat type and a predicted attack probability are obtained from the potential threat prediction result, and a key monitoring indicator is screened out from the multi-dimensional monitoring data based on the predicted threat type; A historical mean value and a standard deviation of the key monitoring indicator in a specified time window are used as a monitoring baseline, a difference value is calculated by using a current value of the key monitoring indicator and the corresponding historical mean value in the monitoring baseline, the deviation value is obtained by dividing the difference value by the corresponding standard deviation, and an abnormal behavior is marked when the deviation value is greater than an abnormality detection threshold; When the abnormal behavior is detected, an abnormal behavior feature vector is extracted from abnormal behavior data, an attack feature vector related to the predicted threat type is searched in the security threat knowledge graph, a cosine similarity between the abnormal behavior feature vector and the attack feature vector is calculated to obtain a threat feature similarity; Based on the threat feature similarity, the attack feature in the security threat knowledge graph is matched, and a threat type corresponding to an attack feature with the highest matching degree is selected; and a threat level is obtained based on the deviation value, the threat feature similarity and the predicted attack probability. Generate security threat alarm information based on the threat type, the threat level, and the value assessment result of the currently attacked financial service.

4. The method of claim 1, wherein, Extract the service fingerprint feature of the security threat alarm information, configure a dynamic honeypot environment, keep the response characteristics of the dynamic honeypot environment consistent with the characteristics of the currently attacked financial service, and include: Extract the service fingerprint feature of the currently attacked financial service from the security threat alarm information, generate a target service feature set, calculate the mean and variance of the service response time sequence in the target service feature set, generate a time delay baseline parameter, extract the interaction protocol parameter in the target service feature set, and generate an interaction rule set; configure the dynamic honeypot environment according to the time delay baseline parameter and the interaction rule set, so that the response characteristics of the dynamic honeypot environment are consistent with the fingerprint characteristics of the currently attacked financial service; Extract abnormal behavior features from the security threat alarm information based on the threat type, calculate the deviation ratio between the request frequency of each data flow in the current network traffic and the frequency baseline in the abnormal behavior features, compare the request URL with the access path features in the abnormal behavior features, and calculate the path difference degree; weight the deviation ratio and the path difference degree to obtain the traffic suspiciousness score; When the traffic suspiciousness score is greater than the traffic diversion threshold, configure a traffic mirroring rule at the upstream gateway node of the currently attacked financial service; through transparent proxy technology, the traffic meeting the traffic mirroring rule is diverted to the dynamic honeypot environment.

5. The method of claim 1, wherein, In the dynamic honeypot environment, implant a marker code to record the behavior trajectory of the attacker, analyze the attack intention and technical characteristics of the attacker according to the behavior trajectory, generate a protection rule for the financial transaction scene in real time according to the attack intention and technical characteristics, and deploy the protection rule to the financial business production environment including: Implant a marker code in the system call layer, memory space, command execution layer, and network communication layer in the dynamic honeypot environment, capture the operation sequence of the attacker at each layer, and generate an attack behavior trajectory; extract operation type distribution features, target resource access features, attack tool features, and attack link features from the attack behavior trajectory, weight and combine each feature according to the corresponding weight coefficient to obtain an attack intention feature vector; based on the attack intention feature vector, analyze the behavior pattern of the attacker, determine the attacked data, and identify the technical means and attack path used by the attacker; the behavior pattern, the attacked data, the technical means, and the attack path are the attack technical characteristics; Generate a protection rule candidate set according to the attack intention feature vector and the attack technical characteristics; The matching degree of each rule in the protection rule candidate set to known attack behaviors is calculated to obtain rule coverage, the false positive probability of the rule is calculated to obtain rule validity, and the resource consumption of rule execution is calculated to obtain rule performance overhead; the rule coverage, the rule validity, and the rule performance overhead are weighted and calculated to obtain a rule score; the protection rules are screened according to the rule score, and a final protection rule set is generated; and the final protection rule set is deployed into a financial business production environment.

6. A cloud-native application security protection and monitoring system for financial technology, configured to implement the method of any one of claims 1-5, characterized in that, Comprise: A first unit configured to obtain multi-dimensional monitoring data from a financial technology cloud native application; A second unit configured to establish an initial security threat knowledge graph based on the multi-dimensional monitoring data, semantically model historical security events according to attack chains, establish a multi-level knowledge structure based on semantic correlation, and obtain a complete security threat knowledge graph based on the multi-level knowledge structure; A third unit configured to identify a high-risk attack path in the complete security threat knowledge graph through a graph convolution network, perform feature matching on the high-risk attack path and the multi-dimensional monitoring data, calculate an attack occurrence probability according to threat correlation rules, and generate a potential threat prediction result; A fourth unit configured to identify abnormal behavior by calculating the deviation value of a key monitoring indicator based on the potential threat prediction result, perform similarity matching on the abnormal behavior features and attack features in the security threat knowledge graph when the abnormal behavior is detected, determine a threat type and a threat level, and generate security threat alarm information; A fifth unit configured to extract service fingerprint features of the security threat alarm information, configure a dynamic honeypot environment, keep the response features of the dynamic honeypot environment consistent with the features of the current attacked financial service, divert suspicious traffic to the dynamic honeypot environment through traffic mirroring technology, implant a marker code in the dynamic honeypot environment to record the behavior trajectory of the attacker, analyze the attack intention and technical characteristics of the attacker according to the behavior trajectory, generate protection rules for the financial transaction scene in real time according to the attack intention and technical characteristics, and deploy the protection rules to a financial business production environment.

7. An electronic device, comprising: Comprise: A processor; A memory for storing processor-executable instructions; The processor is configured to invoke the instructions stored in the memory to execute the method of any one of claims 1 to 5.

8. A computer-readable storage medium having stored thereon computer program instructions, wherein, The computer program instructions are executed by the processor to implement the method of any one of claims 1 to 5.

Images