Cloud side-end collaborative interaction adaptive security device

Abstract

The invention discloses a cloud side end collaborative interaction adaptive security device, and belongs to the technical field of information. The method comprises the steps of collecting original data through terminal equipment, and preprocessing the original data to obtain first data; performing encryption processing on the first data by using an AES-128 symmetric encryption algorithm to obtain encrypted data; digital signature and authentication are carried out on encrypted data; decrypting the successfully authenticated encrypted data to obtain second data; performing anomaly detection on the second data to obtain normal data or abnormal data, and recording the abnormal data and an anomaly reason through a log; keyword extraction is carried out according to exception reasons corresponding to different exception data, matching with a keyword database is carried out, and corresponding exception types are obtained; and periodically counting the occurrence frequency of the exception reason corresponding to each exception type, and grading the exception degrees of different terminal devices according to the exception evaluation coefficient.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information technology, and in particular to a cloud-edge-terminal collaborative interaction adaptive security device. BACKGROUND

[0002] With the rapid development of 5G and Internet of Things technology, the amount of data generated by terminal devices increases exponentially. These data contain a large amount of private information such as geographic location, and the security and privacy protection problems need to be solved. At the same time, cloud computing centers, edge devices and terminal devices need to conduct comprehensive security and privacy analysis from the data, model and system levels when facing different types of attacks.

[0003] In the "cloud-edge-terminal" architecture, the terminal is responsible for comprehensive perception, the edge is responsible for local data analysis and reasoning, and the cloud collects all edge perception data, business data and Internet data to complete industry and cross-industry situation awareness and analysis, to a certain extent, realizing collaborative processing and service provision of data, but still insufficient in the face of complex security threats and resource limitations.

[0004] Therefore, the present application proposes a cloud-edge-terminal collaborative interaction adaptive security device for collaborative work between cloud computing, edge computing and terminal devices, which combines asymmetric encryption algorithm and digital signature technology to realize safer and more efficient data processing and privacy protection; at the same time, in the cloud computing center, the trained Gaussian mixture model is used to effectively detect anomalies in collected data, realizing adaptive security protection. SUMMARY

[0005] The purpose of the present application is to provide a cloud-edge-terminal collaborative interaction adaptive security device to solve the problems in the background art.

[0006] The purpose of the present application can be achieved by the following technical solution: a cloud-edge-terminal collaborative interaction adaptive security device, comprising a data acquisition and processing module, which collects raw data from various terminal devices and pre-processes the raw data to obtain first data;

[0007] A data encryption module uses an AES-128 symmetric encryption algorithm to encrypt the first data to obtain encrypted data;

[0008] A data authentication module digitally signs and authenticates the encrypted data;

[0009] An anomaly identification module decrypts the encrypted data that has passed authentication to obtain second data; performs anomaly detection on the second data to obtain normal data or abnormal data, and records abnormal data and abnormal reasons through a log;

[0010] The abnormal reason corresponding to different abnormal data is extracted by keyword extraction, and the obtained abnormal keyword phrase is matched with a pre-constructed keyword database to obtain an abnormal type corresponding to each abnormal keyword;

[0011] The number of occurrences of the abnormal reason corresponding to each type of abnormality is periodically counted, and the abnormal degree of different terminal devices is graded according to the calculated abnormal evaluation coefficient.

[0012] Preferably, the collected raw data is pre-processed to remove redundant or inaccurate data, eliminate invalid or abnormal data, and convert the raw data into a standard format to obtain the first data; wherein the raw data includes network traffic data collected by a plurality of terminal devices.

[0013] Preferably, the AES-128 symmetric encryption algorithm specifically includes:

[0014] Initial transformation: split the plaintext, i.e. the first data, into individual plaintext blocks, each plaintext block being 128 bits long, i.e. 16 bytes; if the last plaintext block is less than 16 bytes, it is padded with the Padding attribute;

[0015] Organize all the plaintext blocks into a 4x4 matrix, labeled as the state matrix;

[0016] Round key addition operation on the state matrix: exclusive OR operation of each byte in the state matrix with a randomly generated initial key to obtain a first key addition matrix;

[0017] n-round cyclic encryption: byte substitution, row shifting, column confusion and round key addition operation on the target matrix;

[0018] In the first round of cyclic encryption, the target matrix is the first key addition matrix obtained by the initial transformation; in the next n-1 rounds of cyclic encryption, the target matrix is the second key addition matrix obtained by the previous round of cyclic encryption;

[0019] Byte substitution operation on the target matrix: each byte in the target matrix is used as an index to find its corresponding value from a substitution table with 256 values, and the byte value is replaced with the corresponding value to obtain a byte substitution output matrix;

[0020] Row shifting operation on the rows of the byte substitution output matrix: the first row is not moved, the second row is left shifted by 1 byte, the third row is left shifted by 2 bytes, and the fourth row is left shifted by 3 bytes to obtain a row shifting output matrix;

[0021] Column confusion operation on the columns of the row shifting output matrix: multiplication operation using a fixed matrix to obtain a column confusion output matrix;

[0022] The column confusion output matrix is subjected to a round key addition operation, and the column confusion output matrix is subjected to an exclusive or operation with a round key to obtain a second key addition matrix; wherein the round key is obtained by performing key expansion on the initial key through a key scheduling algorithm to generate a plurality of round keys, and the length of the round key is equal to the group length;

[0023] The last round of encryption: obtaining the second key addition matrix after n times of cyclic encryption, only performing byte substitution, row shifting and round key addition operation on the second key addition matrix, and outputting the encrypted matrix as the ciphertext, that is, the encrypted data;

[0024] The encryption process is as follows:

[0025] C=E(K,P);

[0026] In the formula, C is the encrypted ciphertext, K is the key, P is the plaintext, and E is the encryption function.

[0027] Preferably, the data authentication module specifically comprises: performing a hash operation on the encrypted data to be sent to obtain a first hash value of a fixed length, randomly selecting a pair of signature public key and signature private key, encrypting the first hash value by using the signature private key to generate a digital signature, and sending the encrypted data to be sent and the digital signature to the edge side;

[0028] The edge side receives the encrypted data and the digital signature, traverses the database to obtain the signature public key, decrypts the digital signature by using the signature public key to obtain the first hash value; performs the same hash operation on the received encrypted data to obtain a second hash value; and performs data authentication on the first hash value and the second hash value, if the first hash value is equal to the second hash value, it means that the authentication is successful; otherwise, it means that the authentication fails.

[0029] Preferably, the anomaly identification module specifically comprises: decrypting the encrypted data of which the authentication is successful to obtain second data, inputting the second data into a trained Gaussian mixture model for anomaly detection, obtaining the probability density of the Gaussian distribution to which each second data belongs, and judging the probability density with a preset probability threshold value;

[0030] If the probability density of the second data in the Gaussian distribution to which it belongs is greater than the probability threshold value, it is determined that the data is normal; otherwise, it is determined that the data is abnormal, and an alarm is immediately sent out, and the abnormal data and the abnormal reason are recorded through a log.

[0031] Preferably, the method for constructing the Gaussian mixture model is as follows: selecting historical second data that has been processed and marked as training data x1, x2,...,x N N is the total number of training data; the number of sub-Gaussian models in the Gaussian mixture model is set to K, k=1, 2, 3,..., K; wherein, the sub-Gaussian model also represents a Gaussian distribution;

[0032] Calculate the probability distribution of the Gaussian mixture model;

[0033] The calculation formula is:

[0034]

[0035] In the formula, x represents the training data; α k represents the probability that the training data belongs to the kth submodel, satisfying α k ≥ 0 and φ(x|θ k ) represents the Gaussian distribution density function of the kth submodel; θ k represents the parameters corresponding to each submodel, and θ k =(μ k ,∑ k ) represents the probability that the mean and covariance of each sub-module occur in the Gaussian mixture model, wherein μ k and ∑ k represent the mean and covariance of each sub-module, respectively.

[0036] Set the initial parameters, denoted as the first set of parameters and Solve the optimal parameters of the Gaussian mixture model using the EM iterative algorithm;

[0037] Obtain the first set of parameters, complete a round of iterative update based on the E-step and M-step in the EM iterative algorithm, and obtain the second set of parameters and

[0038] Obtain the second set of parameters, complete a round of iterative update based on the E-step and M-step in the EM iterative algorithm, and obtain the third set of parameters and

[0039] By analogy, repeat the above process until and ε> 0, indicating that the parameter changes very little after one iteration; mark the obtained i+1th set of parameters as the optimal parameters θ k =(μ k ,∑ k ) and α k of the Gaussian mixture model; wherein i is a positive integer.

[0040] Preferably, the E-step is: obtaining the i th set of parameters, calculating the probability that each training data belongs to the kth submodel;

[0041] The calculation formula is:

[0042]

[0043] In the formula, γ jk represents the probability that the jth training data belongs to the kth sub-model; x j represents the jth training data, j = 1, 2, 3,..., N.

[0044] Preferably, the M-step is to calculate the model parameters of a new round of iteration to obtain the i+1th set of parameters.

[0045] The calculation formula is:

[0046]

[0047]

[0048] In the formula, The i+1th set of parameters after iteration.

[0049] Preferably, the anomaly evaluation module specifically includes: traversing the log to obtain abnormal reasons corresponding to different abnormal data, performing keyword extraction on all abnormal reasons to obtain abnormal keyword phrases, and sequentially matching the abnormal keyword phrases with a pre-constructed keyword database;

[0050] If the matching is successful, the abnormal type corresponding to the abnormal keyword in the keyword database is obtained; if the matching is unsuccessful, the abnormal keyword is submitted to an auditing personnel to obtain the corresponding abnormal type;

[0051] A month is formulated as a monitoring period, and the number of occurrences of abnormal reasons corresponding to each type of abnormal type is periodically counted to calculate an abnormal evaluation coefficient;

[0052] The calculation formula is:

[0053]

[0054] In the formula, QX represents the abnormal evaluation coefficient, ω v represents the weight corresponding to the vth type of abnormal type, v = 1, 2, 3,..., V, V is a positive integer; U v is the number of occurrences of abnormal reasons corresponding to the vth type of abnormal type.

[0055] According to the abnormal evaluation coefficient obtained by calculation, the abnormal degree of different terminal equipment is graded, if 0≤QX≤0.5, the abnormal degree is“mild”, then routine inspection or small-scale intervention is required; if 0.5

[0056] Compared with the prior art, the present application has the following beneficial effects:

[0057] This invention collects raw data through a terminal device, preprocesses the raw data to obtain first data, which helps ensure data quality and consistency; it encrypts the first data using the AES-128 symmetric encryption algorithm to obtain encrypted data, ensuring data security during transmission and storage; and it digitally signs and authenticates the encrypted data, which helps ensure data integrity and source authentication, preventing data from being tampered with during transmission.

[0058] This invention obtains normal or abnormal data by performing anomaly detection on the second data, and records the abnormal data and its causes through logs, which helps to promptly detect security threats or performance problems. By extracting keywords from the anomaly causes corresponding to different abnormal data and matching them with a keyword database, the corresponding anomaly types are obtained. The number of occurrences of the anomaly causes corresponding to each anomaly type is periodically counted, and the anomaly severity of different terminal devices is classified according to the anomaly evaluation coefficient, which is conducive to realizing anomaly detection of collected data and improving network security. Attached Figure Description

[0059] The invention will now be further described with reference to the accompanying drawings.

[0060] Figure 1 This is a block diagram of a cloud-edge-device collaborative interactive adaptive security device according to the present invention. Detailed Implementation

[0061] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0062] Example 1, such as Figure 1 As shown, a cloud-edge-device collaborative interactive adaptive security device includes a data acquisition and processing module, a data encryption module, a data authentication module, and an anomaly detection module.

[0063] The data acquisition and processing module is used to collect a large amount of network traffic data from various terminal devices to obtain raw data; to preprocess the collected raw data, remove redundant or inaccurate data, eliminate invalid or abnormal data, and convert the raw data into a standard format to obtain the first data; among which, the standard format includes, but is not limited to, CSV format and JSON format.

[0064] The data encryption module uses the AES-128 symmetric encryption algorithm to encrypt the first data, resulting in encrypted data, specifically including:

[0065] Initial transformation: split the plaintext, i.e. the first data, into individual plaintext blocks, each plaintext block having a length of 128 bits, i.e. 16 bytes, and if the last plaintext block is less than 16 bytes, padding is used to fill it up;

[0066] Organize all the plaintext blocks into a 4x4 matrix, which is marked as the state matrix;

[0067] Round key addition operation on the state matrix, i.e. exclusive OR operation between each byte in the state matrix and a randomly generated initial key, to obtain a first key addition matrix;

[0068] n rounds of cyclic encryption: byte substitution, row shifting, column confusion and round key addition operation are performed on the target matrix;

[0069] In the first round of cyclic encryption, the target matrix is the first key addition matrix obtained by the initial transformation; in the following n-1 rounds of cyclic encryption, the target matrix is the second key addition matrix obtained by the previous round of cyclic encryption;

[0070] Byte substitution operation on the target matrix, i.e. finding the corresponding value of each byte in the target matrix from a substitution table having 256 values, and replacing the value of the byte with the corresponding value, to obtain a byte substitution output matrix;

[0071] Row shifting operation on the rows of the byte substitution output matrix, i.e. the first row is not moved, the second row is shifted left by 1 byte, the third row is shifted left by 2 bytes, and the fourth row is shifted left by 3 bytes, to obtain a row shifting output matrix;

[0072] Column confusion operation on the columns of the row shifting output matrix, i.e. multiplication operation using a fixed matrix, to obtain a column confusion output matrix; wherein the fixed matrix is given according to the actual encryption algorithm;

[0073] Round key addition operation on the column confusion output matrix, i.e. exclusive OR operation between the column confusion output matrix and a round key, to obtain a second key addition matrix; wherein the round key is obtained by key expansion of the initial key through a key scheduling algorithm, and the round key has a length equal to the block length;

[0074] Final round of encryption: obtain the second key addition matrix after n times of cyclic encryption, and only perform byte substitution, row shifting and round key addition operation on the second key addition matrix, to output the encrypted matrix as the ciphertext, i.e. the encrypted data;

[0075] The encryption process is as follows:

[0076] C = E(K, P);

[0077] wherein C is the encrypted ciphertext, K is the key, P is the plaintext, and E is the encryption function;

[0078] In this embodiment, the first data is encrypted using the AES-128 symmetric encryption algorithm to enhance the security of data transmission and storage. The patent technology adopts a cloud-edge-end collaborative architecture, under which data can be preliminarily processed on the edge device near the user end, and then the encrypted data is transmitted to the cloud for further storage and analysis.

[0079] The data authentication module performs a hash operation on the encrypted data to be sent to obtain a first hash value of a fixed length, randomly selects a pair of signature public key and signature private key, encrypts the first hash value using the signature private key to generate a digital signature, and sends the encrypted data to be sent and the digital signature to the edge end;

[0080] The edge end receives the encrypted data and the digital signature, traverses the database to obtain the signature public key, decrypts the digital signature using the signature public key to obtain the first hash value, performs the same hash operation on the received encrypted data to obtain a second hash value, and performs data authentication on the first hash value and the second hash value. If the first hash value is equal to the second hash value, it means that the authentication is successful; otherwise, it means that the authentication fails;

[0081] In this embodiment, the obtained encrypted data is digitally signed and authenticated, further ensuring the authenticity and tamper resistance of the data. Even if the data is intercepted during transmission, the integrity and authenticity of the data can be confirmed by verifying the digital signature.

[0082] The anomaly recognition module decrypts the encrypted data whose authentication is successful to obtain second data, inputs the second data into the trained Gaussian mixture model for anomaly detection, obtains the probability density of each second data in the Gaussian distribution to which it belongs, and judges it with a preset probability threshold;

[0083] It should be noted that the probability density of each second data in the Gaussian distribution to which it belongs reflects the degree to which each second data conforms to a certain Gaussian distribution. The lower the probability, the less the second data conforms to the distribution;

[0084] If the probability density of the second data in the Gaussian distribution to which it belongs is greater than the probability threshold, it is determined to be normal data; otherwise, it is determined to be abnormal data, and an alarm is immediately issued, and the abnormal data and the abnormal reason are recorded through the log. The probability threshold is set according to business requirements and risk acceptance;

[0085] Exemplarily, the network inflow and outflow of the terminal device under normal circumstances follow a certain Gaussian distribution, if the probability density of the inflow or outflow at a moment is less than or equal to a preset probability threshold, the inflow or outflow at the moment is abnormal data, at this time, the system will immediately issue an alarm, check the specific abnormal reason and record, wherein, the abnormal reason includes but is not limited to suffering from DDoS attack, terminal device failure, network configuration subnet mask error;

[0086] The method for constructing the Gaussian mixture model is as follows: selecting the historical second data that has been processed as training data x1, x2,..., x N N is the total number of training data; the number of sub Gaussian models in the Gaussian mixture model is set to K, k = 1, 2, 3,..., K; wherein, the sub Gaussian model also represents the Gaussian distribution;

[0087] Calculate the probability distribution of the Gaussian mixture model;

[0088] The calculation formula is:

[0089]

[0090] In the formula, x represents the training data; α k represents the probability that the training data belongs to the kth sub model, and satisfies α k ≥ 0 and φ(x|θ k ) represents the Gaussian distribution density function of the kth sub model; θ k represents the parameters corresponding to each sub model, and θ k =(μ k ,∑ k ) represents the probability that the mean and covariance of each sub module occur in the Gaussian mixture model, wherein, μ k and ∑ k represent the mean and covariance of each sub module, respectively;

[0091] Set the initialization parameters, denoted as the first group of parameters and Solve the optimal parameters of the Gaussian mixture model by using the EM iterative algorithm;

[0092] Get the first group of parameters, complete a round of iteration update based on the E-step and M-step in the EM iterative algorithm, and get the second group of parameters and

[0093] Get the second group of parameters, complete a round of iteration update based on the E-step and M-step in the EM iterative algorithm, and get the third group of parameters and

[0094] Similarly, repeat the above process until and ε > 0, indicating that the parameter changes very small after one iteration; the obtained i+1 group of parameters is marked as the optimal parameters θ of the Gaussian mixture model k = (μ k ,∑ k ) and α k ; wherein, i is a positive integer;

[0095] The E-step is: obtaining the i-th group of parameters, calculating the probability of each training data belonging to the sub-model k;

[0096] The calculation formula is:

[0097]

[0098] In the formula, γ jk represents the probability that the j-th training data belongs to the k-th sub-model; x j represents the j-th training data, j = 1, 2, 3,..., N;

[0099] The M-step is: calculating the model parameters of a new round of iteration to obtain the i+1 group of parameters;

[0100] The calculation formula is:

[0101]

[0102] In the formula, the i+1 group of parameters after iteration;

[0103] In this embodiment, the Gaussian mixture model is used for intelligent abnormality judgment of the second data, which not only improves the ability to process complex data, but also provides strong technical support for network security protection; at the same time, with the continuous change of network environment and the emergence of new attack means, it is necessary to regularly retrain and update the model to maintain its effectiveness.

[0104] Embodiment 2: based on embodiment 1, further comprising:

[0105] An abnormality evaluation module traverses the log to obtain abnormal reasons corresponding to different abnormal data, extracts keywords from all abnormal reasons to obtain abnormal keyword phrases; wherein, the keyword extraction can be implemented by existing conventional keyword extraction algorithm, and the specific steps are not repeated here;

[0106] The abnormal keyword phrases are compared and matched with the pre-constructed keyword database in sequence; if the matching is successful, the abnormal type corresponding to the abnormal keyword in the keyword database is obtained; if the matching is unsuccessful, the abnormal keyword is submitted to the auditing personnel for auditing to obtain the corresponding abnormal type;

[0107] It should be noted that the keyword database contains different exception types, each exception type contains various exception keywords and variants thereof, and before actual use, the keyword database is regularly updated through multiple training using historical exception data, so as to ensure that the keyword database can accurately match various exception keywords.

[0108] A month is formulated as a monitoring cycle, and the number of occurrences of the exception reason corresponding to each type of exception is periodically counted to calculate an exception evaluation coefficient.

[0109] The calculation formula is:

[0110]

[0111] In the formula, QX represents the exception evaluation coefficient, and ω v v=1, 2, 3,..., V, V is a positive integer; U v is the number of occurrences of the exception reason corresponding to the vth type of exception.

[0112] According to the exception evaluation coefficient obtained by calculation, the degree of exception of different terminal devices is graded, if 0≤QX≤0.5, the degree of exception is "slight", then routine inspection or small-scale intervention is needed; if 0.5

[0113] In the several embodiments provided in the present application, it should be understood that the disclosed system can be implemented in other ways. For example, the above-described embodiments of the application are merely illustrative, for example, the division of the modules is only a logical function division, and actual implementation can have another division manner.

[0114] The modules illustrated as separate components can or can not be physically separated, and the components illustrated as modules can or can not be physical units, i.e., they can be located in one place, or distributed on multiple network units. According to actual needs, part or all of the modules can be selected to achieve the purpose of the embodiment.

[0115] In addition, each functional module in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of hardware plus software functional modules.

[0116] It is apparent for a person skilled in the art that the present application is not limited to the details of the above-described exemplary embodiments, but that the present application can be implemented in other concrete forms without departing from the spirit or essential characteristics of the present application.

[0117] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application but not to limit the present application, and although the present application has been described in detail with reference to the preferred embodiments, those ordinarily skilled in the art should understand that the technical solutions of the present application can be modified or equivalently replaced without departing from the spirit and scope of the present application.

Claims

1. A cloud edge end collaborative interaction adaptive security device, characterized in that, The application relates to a data processing method and device. The data collection processing module collects original data from various terminal devices and pre-processes the original data to obtain first data; The data encryption module uses an AES-128 symmetric encryption algorithm to implement encryption processing on the first data to obtain encrypted data; The data authentication module digitally signs and authenticates the encrypted data; The abnormality identification module decrypts the encrypted data to obtain second data; The abnormality evaluation module extracts keywords from the abnormality reasons corresponding to different abnormality data, matches the obtained abnormality keyword groups with a pre-constructed keyword database, and obtains the abnormality types corresponding to each abnormality keyword; The abnormality evaluation module periodically counts the number of times that the abnormality reasons corresponding to each abnormality type occur, and grades the abnormality degrees of different terminal devices according to the calculated abnormality evaluation coefficients. The original data collected are pre-processed to remove redundant or inaccurate data, eliminate invalid or abnormal data, and convert the original data into a standard format to obtain the first data; wherein the original data include network flow data collected by multiple terminal devices. 2.The cloud-edge-end collaborative interaction adaptive security device according to claim 1, wherein, The AES-128 symmetric encryption algorithm specifically includes: 3.The cloud-edge-end collaborative interaction adaptive security device according to claim 1, wherein, Initial transformation: the plaintext, i.e. the first data, is split into independent plaintext blocks, each plaintext block has a length of 128 bits, i.e. 16 bytes, and if the last plaintext block is less than 16 bytes, padding is used for filling; All the plaintext blocks are organized into a 4x4 matrix, which is marked as a state matrix; Round key addition operation is performed on the state matrix, each byte in the state matrix is subjected to XOR operation with a randomly generated initial key to obtain a first key addition matrix; n-round cyclic encryption: byte substitution, row shifting, column confusion and round key addition operations are performed on the target matrix; In the first round of cyclic encryption, the target matrix is the first key addition matrix obtained through the initial transformation; in the following n-1 rounds of cyclic encryption, the target matrix is a second key addition matrix obtained through the previous round of cyclic encryption; Byte substitution operation is performed on the target matrix, each byte in the target matrix is used as an index to find a corresponding value from a substitution table with 256 values, and the corresponding value is used to replace the value of the byte to obtain a byte substitution output matrix; Row shifting operation is performed on the rows of the byte substitution output matrix, the first row is not moved, the second row is moved left by 1 byte, the third row is moved left by 2 bytes, and the fourth row is moved left by 3 bytes to obtain a row shifting output matrix; Column confusion operation is performed on the columns of the row shifting output matrix, multiplication operation is performed using a fixed matrix to obtain a column confusion output matrix; Round key addition operation is performed on the column confusion output matrix, the column confusion output matrix is subjected to XOR operation with a round key to obtain a second key addition matrix; wherein the round key is obtained by key expansion of the initial key through a key arrangement algorithm, and a plurality of round keys are generated, and the round key has a length equal to the group length. ​ Final round of encryption: obtain the second key addition matrix after n rounds of loop encryption, only perform byte substitution, row shift and round key addition operations on the second key addition matrix, and output the encrypted matrix as the ciphertext, i.e. encrypted data; The encryption process is: C = E(K, P); In the formula, C is the encrypted ciphertext, K is the key, P is the plaintext, and E is the encryption function.

4. The cloud edge-end collaborative interaction adaptive security device according to claim 3, wherein, The data authentication module specifically comprises: performing a hash operation on the encrypted data to be sent to obtain a first hash value of a fixed length, randomly selecting a pair of signature public key and signature private key, encrypting the first hash value by using the signature private key to generate a digital signature, and sending the encrypted data to be sent and the digital signature to the edge; The edge receives the encrypted data and the digital signature, traverses the database to obtain the signature public key, decrypts the digital signature by using the signature public key to obtain the first hash value; the same hash operation is performed on the received encrypted data to obtain a second hash value; the first hash value and the second hash value are subjected to data authentication, and if the first hash value is equal to the second hash value, it is indicated that the authentication is successful; otherwise, it is indicated that the authentication fails.

5. The cloud edge-end collaborative interaction adaptive security device according to claim 4, wherein, The abnormality identification module specifically comprises: decrypting the encrypted data of which the authentication is successful to obtain second data, inputting the second data into a trained Gaussian mixture model for abnormality detection, obtaining a probability density of each second data in a Gaussian distribution to which the second data belongs, and judging the probability density with a preset probability threshold value; If the probability density of the second data in the Gaussian distribution to which the second data belongs is greater than the probability threshold value, the second data is determined to be normal data; otherwise, the second data is determined to be abnormal data, and an alarm is immediately sent, and the abnormal data and the abnormal reason are recorded through a log.

6. The cloud edge-end collaborative interaction adaptive security apparatus according to claim 5, wherein, The method for constructing the Gaussian mixture model is as follows: selecting the processed historical second data as training data x1, x2,..., x N , and setting the number of sub-Gaussian models in the Gaussian mixture model as K, k = 1, 2, 3,..., K; wherein, the sub-Gaussian model also represents a Gaussian distribution; The probability distribution of the Gaussian mixture model is calculated. The calculation formula is: In the formula, x represents training data; α k represents the probability that the training data belongs to the kth submodel, satisfying α k ≥ 0 and φ(x|θ k ) represents the Gaussian distribution density function of the kth submodel; θ k represents the parameters corresponding to each submodel, and θ k =(μ k ,∑ k ) represents the probability that the mean and covariance of each sub-module occur in the Gaussian mixture model, wherein μ k and ∑ k represent the mean and covariance of each sub-module, respectively; Set initialization parameters, denoted as a first set of parameters and Solve the optimal parameters of the Gaussian mixture model using an EM iterative algorithm. Obtaining a first set of parameters, completing a round of iteration update based on E-step and M-step in EM iteration algorithm to obtain a second set of parameters and Obtaining a second set of parameters, completing a round of iteration update based on E-step and M-step in EM iteration algorithm to obtain a third set of parameters and Similarly, repeat the above process until and ε > 0, indicating that the parameter changes very small after one iteration; the i+1 group of parameters obtained is marked as the optimal parameters θ of the Gaussian mixture model k = (μ k ,∑ k ) and α k ; where i is a positive integer.

7. The cloud edge-end collaborative interaction adaptive security apparatus according to claim 6, wherein, The E-step is: obtaining the i-th group of parameters, and calculating the probability of each training data belonging to the sub-model k; The calculation formula is: where γ jk denotes the probability that the jth training data belongs to the kth sub-model; x j denotes the jth training data, j = 1, 2, 3,..., N. 8.The cloud-edge-end collaborative interaction adaptive security device of claim 6, wherein, The M-step is: calculating the model parameters of a new round of iteration to obtain the i+1-th group of parameters; The calculation formula is: wherein comprises the i+1th iteration of the i+1th group of parameters.

9. The cloud edge-end collaborative interaction adaptive security apparatus according to claim 8, wherein, The abnormality evaluation module specifically comprises: traversing the log to obtain abnormal reasons corresponding to different abnormal data, extracting keywords from all abnormal reasons to obtain abnormal keyword groups, and sequentially matching the abnormal keyword groups with a pre-constructed keyword database; If the matching is successful, the abnormal type corresponding to the abnormal keyword in the keyword database is obtained; If the matching is unsuccessful, the abnormal keyword is submitted to an auditing personnel to obtain the corresponding abnormal type; A month is set as a monitoring cycle, the number of times of occurrence of the abnormal reasons corresponding to each type of abnormality is periodically counted, and an abnormality evaluation coefficient is calculated; The calculation formula is: In the formula, QX represents an anomaly evaluation coefficient, ω v represents the weight corresponding to the vth anomaly type, v = 1, 2, 3,..., V, V being a positive integer; U v is the number of occurrences of the anomaly reason corresponding to the vth anomaly type. According to the calculated abnormality evaluation coefficient, the abnormality degree of different terminal devices is graded, if 0≤QX≤0.5, the abnormality degree is "mild", and routine inspection or small-scale intervention is required; if 0.5

Images