Multi-level network security protection method and system based on cloud computing

Abstract

The application provides a multi-level network security protection method and system based on cloud computing, relates to the technical field of network security, and comprises the following steps: atomically decomposing a hierarchical strategy; performing cross-level association on multi-level atomic protection strategy units based on a strategy dependency relationship; after an initial access behavior is received by a protection cloud, behavior dimension feature extraction is performed; a pruning logic matrix is constructed according to a multi-dimensional behavior feature vector, an activated state protection strategy tree is generated, atomic protection strategy units are issued by the protection cloud layer by layer, and layered risk verification is performed; a hierarchical risk quantization tree is subjected to nonlinear risk integration based on a time attenuation rule; and if a dynamic risk evaluation value does not satisfy a preset safety threshold, a dynamic fuse protection label is identified to an access ID. Through the application, the technical problem that the network security protection lags behind and the network security protection efficiency is affected due to the fact that the network security protection depends on static rules and strategies in the prior art is solved, and the overall security protection efficiency is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a multi-level network security protection method and system based on cloud computing. BACKGROUND

[0002] At present, existing network security protection relies on a pre-defined static rule and policy library, and threat detection and interception are performed through feature matching. However, static rules are difficult to cope with rapidly evolving attack methods and unknown threats, resulting in a high false negative rate, and the updating and adaptability of protection strategies are poor. On the other hand, the security incident response process relies on manual analysis, and the entire cycle from log collection, correlation analysis to decision-making and disposal is long, so that attackers can use this time window to implement horizontal movement and data theft, reducing the security protection response efficiency and real-time protection capability. Especially in multi-level network security protection, the existing various security strategies lack dynamic coordination capability, and are mostly in isolated operation state, and cannot adjust the strategies according to the real-time context of access behavior, resulting in that the execution of protection strategies is not fine enough, and adaptive access control cannot be realized, thereby affecting the overall protection effect and response efficiency.

[0003] In summary, in the prior art, there is a technical problem that network security protection relies on static rules and strategies, the threat response time is long, resulting in lag of attack detection and protection response, which affects the real-time performance and efficiency of network security protection. SUMMARY

[0004] The purpose of the present application is to provide a multi-level network security protection method and system based on cloud computing, to solve the technical problem in the prior art that network security protection relies on static rules and strategies, the threat response time is long, resulting in lag of attack detection and protection response, which affects the real-time performance and efficiency of network security protection.

[0005] In view of the above problems, the present application provides a multi-level network security protection method and system based on cloud computing.

[0006] In a first aspect, the application provides a multi-level network security protection method based on cloud computing, which is implemented by a multi-level network security protection system based on cloud computing. The multi-level network security protection method based on cloud computing comprises: atomically decomposing a hierarchical strategy to obtain a plurality of multi-level atomic protection strategy units; performing cross-level association on the multi-level atomic protection strategy units based on a strategy dependency relationship to construct a hierarchical strategy association tree; after a protection cloud receives an initial access behavior of an access user, performing behavior dimension feature extraction based on the initial access behavior to output a multi-dimensional behavior feature vector; constructing a pruning logic matrix based on the multi-dimensional behavior feature vector, performing mapping pruning on the hierarchical strategy association tree, and generating an activated protection strategy tree; and the protection cloud performs layered risk verification on the access user based on the activated protection strategy tree, generates a hierarchical risk quantization tree, and outputs a dynamic risk evaluation value based on time decay rules and nonlinear risk integration of the hierarchical risk quantization tree; and if the dynamic risk evaluation value does not satisfy a preset security threshold, a dynamic fuse protection label is added to an access ID of the access user.

[0007] Optionally, the multi-level atomic protection strategy units are divided into hierarchical attribution, mapped to a preset protection hierarchical set, and the preset protection hierarchical set comprises a physical layer, a virtualization layer, a network layer, an identity layer, an application layer, a data layer and a monitoring layer; based on a topological relationship of the preset protection hierarchical set, cross-level association path enumeration of the multi-level atomic protection strategy units is performed to obtain P cross-level strategy unit combinations; P associated dependency strength values of the P cross-level strategy unit combinations are networked and called; based on a preset dependency strength threshold, the P associated dependency strength values are traversed, and M cross-level strategy unit combinations are screened from the P cross-level strategy unit combinations; based on the M cross-level strategy unit combinations, cross-level association is performed on the multi-level atomic protection strategy units to construct the hierarchical strategy association tree; and dynamic association strength weight identification is performed on the node association edges of the hierarchical strategy association tree based on M associated dependency strength values of the M cross-level strategy unit combinations.

[0008] Optionally, strategy attribute identification is performed on the multi-level atomic protection strategy units to obtain multi-level atomic strategy attributes of the multi-level atomic protection strategy units, wherein the atomic strategy attributes comprise a strategy type and an action object; P cross-level strategy attribute combinations are called from the multi-level atomic strategy attributes based on the P cross-level strategy unit combinations; and the P cross-level strategy unit combinations and the P cross-level strategy attribute combinations are used as joint query features to network and call the P associated dependency strength values.

[0009] Optionally, the protection cloud end captures access behavior original data of the initial access behavior through a cloud platform service log; extracts access space-time features, access protocol features and device fingerprint features based on the access behavior original data; performs derivative operation correlation starting from the initial access behavior to generate a derivative operation set; performs behavior chain modeling on the derivative operation set to output behavior sequence features; and generates the multi-dimensional behavior feature vector through normalization processing of the behavior sequence features, the access space-time features, the access protocol features and the device fingerprint features.

[0010] Optionally, a pre-constructed policy attribute disabling rule library and a resource object access restriction rule library are separated; the multi-dimensional behavior feature vector is separated to obtain an attribute correlation feature vector and a resource operation correlation feature vector, wherein the attribute correlation feature vector is composed of the access space-time features and the access protocol features, and the resource operation correlation feature vector is composed of the behavior sequence features and the device fingerprint features; the attribute correlation feature vector is used to match an output tabu attribute set in the policy attribute disabling rule library; the resource operation correlation feature vector is used to match an output tabu object set in the resource object access restriction rule library; after the tabu attribute set and the tabu object set are coded into a tabu identification mapping table, the pruning logic matrix is constructed in combination with the multi-dimensional behavior feature vector; and the pruning logic matrix is used to perform tabu-driven pruning on the hierarchical policy correlation tree to generate the activated protection policy tree.

[0011] Optionally, the pruning logic matrix is used to traverse policy attributes of each policy node in the hierarchical policy correlation tree to perform tabu node identification pruning and generate an initial pruning policy tree; in the initial pruning policy tree, the associated edge weight of a pruning node is transferred by inheritance to an adjacent cross-hierarchical activated node to repair the dependence relationship of the pruning node, and the activated protection policy tree is output.

[0012] Optionally, the multi-level atomic policy attributes are reversely injected into the hierarchical policy correlation tree according to the belonging level of the policy nodes in the hierarchical policy correlation tree to supplement the policy node attributes.

[0013] Optionally, heterogeneous computing resources are allocated according to the policy node types of the activated protection policy tree to output a multi-level resource allocation mapping table; the protection cloud end takes the multi-level resource allocation mapping table as a dynamic scheduling constraint, and according to the activated protection policy tree, atomic protection policy units are issued layer by layer to perform layered interception verification on the access user to generate multi-level risk quantification data; according to the topological level dependence relationship of the activated protection policy tree, a node verification dependence order is analyzed to output a hierarchical verification task queue; and according to the hierarchical verification task queue, inter-level risk transmission attenuation compensation of the multi-level risk quantification data is performed to output the hierarchical risk quantification tree.

[0014] Optionally, the node associated edge weight of the hierarchical risk quantification tree is traversed, a node risk value dynamic aggregation calculation is performed, and a node weighted aggregation result is output; a nonlinear risk integration of the node weighted aggregation result is performed based on a time decay rule, and the dynamic risk evaluation value is output.

[0015] In a second aspect, the present application also provides a cloud computing-based multi-level network security protection system for executing the cloud computing-based multi-level network security protection method as described in the first aspect, wherein the cloud computing-based multi-level network security protection system comprises: an atomization decomposition module configured to atomize and decompose a hierarchical policy to obtain a multi-level atomic protection policy unit; a cross-level association module configured to perform cross-level association on the multi-level atomic protection policy unit based on a policy dependency relationship, and construct a hierarchical policy association tree; a dimension feature extraction module configured to, after an initial access behavior of an access user is received by a protection cloud, extract a behavior dimension feature from the initial access behavior, and output a multi-dimensional behavior feature vector; a mapping pruning module configured to construct a pruning logic matrix according to the multi-dimensional behavior feature vector, perform mapping pruning on the hierarchical policy association tree, and generate an activated protection policy tree; a risk verification module configured to, according to the activated protection policy tree, the protection cloud layer by layer issues an atomic protection policy unit to perform layered risk verification on the access user, and generates a hierarchical risk quantification tree; a risk integration module configured to perform nonlinear risk integration on the hierarchical risk quantification tree based on a time decay rule, and output a dynamic risk evaluation value; and a label fusing module configured to, if the dynamic risk evaluation value does not satisfy a preset security threshold, dynamically fuse a protection label to an access ID of the access user.

[0016] The one or more technical solutions provided in the present application have at least the following beneficial effects: by integrating multi-level network security protection policies, a hierarchical network security policy tree is constructed, the policy tree is pruned and activated according to the initial behavior of a user, the user risk is dynamically scored according to the hierarchical verification result of the user in the pruned policy tree, even if all protection layers are broken through, it is not concluded that the user is a safe user, the security of the user is continuously evaluated, potential threats are prevented from being released too early, and the protection policy is adjusted in a timely manner according to the change of the risk, thereby improving the real-time performance and efficiency of the overall network security protection.

[0017] The above description is only a summary of the technical solutions of the present application. In order to enable the technical means of the present application to be more clearly understood, and to be implemented according to the content of the description, and in order to enable the above and other purposes, characteristics and advantages of the present application to be more apparent and easy to understand, the following specific embodiments of the present application are described. It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present application, nor is it intended to limit the scope of the present application. Other features of the present application will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are only exemplary, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of the provided drawings.

[0019] Figure 1 The flowchart of the cloud computing-based multi-level network security protection method of the present application.

[0020] Figure 2 The structural diagram of the cloud computing-based multi-level network security protection system of the present application.

[0021] Explanation of reference numerals: atomization decomposition module 11, cross-level association module 12, dimension feature extraction module 13, mapping pruning module 14, risk verification module 15, risk integration module 16, label fuse module 17. DETAILED DESCRIPTION

[0022] The present application provides a cloud computing-based multi-level network security protection method and system, which solves the technical problem that in the prior art, network security protection relies on static rules and strategies, the threat response time is long, leading to lag of attack detection and protection response, affecting the real-time and efficiency of network security protection. By integrating multi-level network security protection strategies, constructing a hierarchical network security strategy tree, pruning and activating the strategy tree according to the initial behavior of the user, and dynamically scoring the user risk according to the hierarchical verification result of the user in the pruned strategy tree, even if all protection layers are broken through, it is not concluded that the user is a safe user, the user safety is continuously evaluated, the potential threat is prevented from being released too early, and the protection strategy is adjusted in time according to the risk change, thereby improving the real-time and efficiency of the overall network security protection.

[0023] Below, the technical solutions in the present application will be described clearly and completely with reference to the drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. It should be understood that the present application is not limited by the example embodiments described herein. Based on the embodiments of the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application. In addition, it should be noted that, for the convenience of description, only the parts related to the present application are shown in the drawings, not all.

[0024] Embodiment one, please refer to the attached Figure 1 The present application provides a multi-level network security protection method based on cloud computing, wherein the multi-level network security protection method based on cloud computing is executed by a multi-level network security protection system based on cloud computing, and the multi-level network security protection method based on cloud computing specifically comprises the following steps:

[0025] The hierarchical strategy is atomized and decomposed to obtain a multi-level atomic protection strategy unit.

[0026] Specifically, the multi-level network security protection strategy of all security devices is scanned and decomposed by the analysis engine to obtain a large number of hierarchical strategies. The hierarchical strategy is to divide the security protection measures into multiple levels according to the protection requirements, and each level is responsible for different types of security protection tasks. For example, the bottom layer may involve physical security protection, the middle layer may involve identity verification and access control, and the top layer may be data encryption and vulnerability protection. The strategy of each level will be configured according to its specific protection target. The existing multi-level network security protection strategy is decomposed into multiple smaller, independent atomic protection strategy units. Atomic decomposition is to decompose complex macroscopic strategies into the smallest, indivisible strategy units. In network security, atomic protection strategy refers to decomposing complex protection tasks into independent, simple operations or strategy units, and each unit performs independent functions for specific protection targets. For example, assuming that there is a multi-level identity verification strategy, which includes user password verification, multi-factor authentication and device fingerprint identification steps, these steps will be decomposed into multiple atomic protection units: the password verification unit verifies whether the user input password meets the rules; the multi-factor authentication unit is used for the second authentication of the user, such as SMS verification code or dynamic token; the device fingerprint identification unit is used for verification according to the unique identifier of the user device (such as MAC address, device model, etc.).

[0027] After atomization, each atomic unit is organized into different levels according to its protection target and protection level. For example, at the network layer, atomic protection units can include firewall rule verification, intrusion detection system (IDS) monitoring, etc.; at the application layer, API access control, user behavior monitoring, etc.; at the data layer, data encryption, data leakage protection (DLP), etc.

[0028] Although each atomic protection policy unit is executed independently, in actual protection, multiple atomic units are linked according to needs. For example, when a user attempts to log in, the identity verification unit first performs user password verification, and if the password verification is passed, the multi-factor authentication unit is verified, and finally the device fingerprint recognition unit confirms the legality of the device. This layer-by-layer progressive atomic unit cooperation can effectively filter out unqualified access requests, thereby enhancing the overall protection capability.

[0029] Based on the policy dependency relationship, cross-level association is performed on the multiple-level atomic protection policy units to construct a hierarchical policy association tree.

[0030] Further, the application further includes the following steps: performing hierarchical attribution division on the multiple-level atomic protection policy units, and mapping to a preset protection level set, the preset protection level set including a physical layer, a virtualization layer, a network layer, an identity layer, an application layer, a data layer, and a monitoring layer; based on the topology relationship of the preset protection level set, performing cross-level association path enumeration of the multiple-level atomic protection policy units to obtain P cross-level policy unit combinations; networked retrieval of P association dependency strength values of the P cross-level policy unit combinations; based on a preset dependency strength threshold, traversing the P association dependency strength values, and filtering M cross-level policy unit combinations from the P cross-level policy unit combinations; based on the M cross-level policy unit combinations, performing cross-level association on the multiple-level atomic protection policy units to construct the hierarchical policy association tree; and according to M association dependency strength values of the M cross-level policy unit combinations, performing dynamic association strength weight identification on the node association edges of the hierarchical policy association tree.

[0031] Further, the application further includes the following steps: performing policy attribute identification on the multiple-level atomic protection policy units to obtain multiple-level atomic policy attributes of the multiple-level atomic protection policy units, wherein the atomic policy attributes include policy types and action objects; according to the P cross-level policy unit combinations, retrieving P cross-level policy attribute combinations from the multiple-level atomic policy attributes; taking the P cross-level policy unit combinations and P cross-level policy attribute combinations as joint query features, and networked retrieval of the P association dependency strength values.

[0032] Specifically, the multi-level atomic protection strategy units are divided into preset protection levels according to their protection functions, including physical layer, virtualization layer, network layer, identity layer, application layer, data layer and monitoring layer. The level attribution division is to assign each atomic protection strategy unit to a preset protection level, and each level represents different security protection targets and tasks, such as physical layer, network layer, etc. The level attribution division helps to classify and organize the protection strategies, so that each protection level can focus on specific protection tasks. The physical layer is used to protect the security of physical devices, such as hardware firewall, server, router, etc.; the virtualization layer is used to ensure the security of virtual environment and virtual machine, such as the isolation of virtualization platform and resource control; the network layer is used to monitor and protect network communication, such as firewall, intrusion detection, intrusion prevention, etc.; the identity layer involves user identity verification and management, such as username / password, permission management, single sign-on, etc.; the application layer is used to protect the security of application programs, prevent vulnerabilities and attacks, such as Web Application Firewall, API security, etc.; the data layer is used to ensure the security of data, such as data encryption, data backup, sensitive data protection, etc.; the monitoring layer is used to monitor and alarm security events in real time, such as log analysis, security event response, etc.

[0033] The topology relationship is the relative position and connection mode between each protection level. There may be a dependency relationship between levels, and the protection strategy of a level may affect or depend on the strategy execution of other levels. According to the topology relationship of the preset protection level set, the cross-level association path is determined, which represents the mutual influence relationship and cooperation relationship between multiple levels. By analyzing the mutual dependence between each level, the cross-level association path is enumerated. When enumerating the cross-level association path, the combination of multiple strategy units is obtained according to the protection requirements, and these combinations represent the cooperation between multiple levels. By enumerating and combining the protection units, P cross-level strategy unit combinations can be obtained, ensuring effective cooperation between different levels. The P cross-level strategy unit combinations are obtained by enumerating the association path between the cross-level strategy units, and finally obtaining the combination of multiple strategy units, representing the cooperation relationship between multiple protection units in different levels, which can jointly achieve a specific protection target. P is a positive integer greater than 1. For example, 50000 atomic strategy units are decomposed. After level division, they are classified into 7 levels, including 12000 units in network layer, 10000 units in identity layer, 8000 units in application layer, 7000 units in data layer, and 13000 units in other layers. After cross-level association path enumeration, about 2000000 potential cross-level strategy unit combinations are generated, and P is 2000000. A combination contains 3 atomic units: atomic unit (network layer) target IP is database IP, atomic unit (identity layer) user group is DBA, and atomic unit (data layer) operation type is DELETE.

[0034] The multi-level atomic protection strategy units are identified by attributes. Each atomic protection strategy unit defines the type and object of the strategy according to its function and object. The strategy type represents the category or function of the protection strategy, such as identity authentication strategy, traffic monitoring strategy, data encryption strategy, etc. The object represents the applicable object of the strategy, such as user identity, network traffic, file data, etc. The atomic strategy attribute is the basic attribute of each protection strategy unit. The attribute of each atomic strategy unit is composed of its strategy type and object, which constitutes the basic identification information of the strategy.

[0035] According to the combination of P cross-level strategy units, the multi-level atomic strategy attributes are traversed, and the corresponding atomic strategy attributes are called to obtain the combination of P cross-level strategy units. Each cross-level strategy unit combination can describe its function and target in the protection system through these attribute information. The P cross-level strategy unit combinations and P cross-level strategy unit combinations are used as joint query features to obtain relevant strategy execution information or evaluation results through networking requests, considering the type, object and cross-level cooperation context information of the protection strategy unit. By calling relevant information through networking, the association dependency strength value of each cross-level strategy unit combination is obtained, that is, the dependency degree and importance of each combination in the protection system, and the most critical strategy unit combination is identified, so as to preferentially execute these high-dependency protection measures. The association dependency strength value is the strength evaluation value of each strategy unit combination, which represents the priority and importance of the combination in the protection system. Higher strength value means that the combination has higher influence on the overall protection. For example, when the identity verification type strategy and behavior monitoring type strategy are combined to be applied to data objects, the association strength baseline value is 0.75, and when the combination further includes an access control type strategy for a specific port, the abnormal risk of the combination is significantly increased, and the association strength value is adjusted to 0.92 by the model. The knowledge base takes an average of 15 milliseconds to process the query, and finally returns the strength value 0.92.

[0036] The preset dependency strength threshold is a pre-set threshold value, such as 0.7, which is used to filter out invalid or secondary combinations with weak association, and only keep strong association combinations. Based on the preset dependency strength threshold, the P association dependency strength values are traversed, and M cross-level strategy unit combinations are selected from the P cross-level strategy unit combinations, eliminating combinations with weak association, to obtain M high-confidence strong association strategy combinations, that is, M cross-level strategy unit combinations.

[0037] According to the combination of M cross-level policy units, cross-level association is performed on the multi-level atomic protection policy units, which means that policy units from different protection levels are effectively connected and cooperated to achieve more comprehensive and deep protection. Based on the cross-level association, a hierarchical policy association tree is constructed to show the hierarchical relationship of the protection policy units in a tree structure. Each node of the tree represents a policy unit, and each edge represents the cooperation or dependency relationship between the policy units. The hierarchical policy association tree is a structure that combines different hierarchical protection policy units. Each node represents a protection policy unit, and the edges represent the association relationship between the policy units.

[0038] According to the M association dependency strength values of the M cross-level policy unit combinations, the weight of each node association edge in the hierarchical policy association tree is dynamically adjusted, that is, it is identified on the node association edge between the corresponding two hierarchical policies. That is, the calculated association dependency strength value is assigned to the corresponding node association edge as the weight attribute of the edge. For example, if a certain policy unit combination has a higher dependency strength in the protection system, the corresponding node association edge weight will be larger. By enumerating the cross-level association path and screening the dependency strength value, the most effective policy combination is identified and activated, avoiding redundant protection measures and improving protection efficiency. According to the dynamically assigned weight, key security policies can be preferentially executed to ensure the efficiency and real-time performance of network security protection.

[0039] After the protection cloud receives the initial access behavior of the access user, behavior dimension feature extraction is performed according to the initial access behavior, and a multi-dimensional behavior feature vector is output.

[0040] Further, the present application further includes the following steps: the protection cloud captures access behavior raw data of the initial access behavior through cloud platform service logs; based on the access behavior raw data, access spatio-temporal features, access protocol features and device fingerprint features are extracted; derivative operation association is performed starting from the initial access behavior to generate a derivative operation set; behavior chain modeling is performed on the derivative operation set to output behavior sequence features; the behavior sequence features, access spatio-temporal features, access protocol features and device fingerprint features are normalized to generate the multi-dimensional behavior feature vector.

[0041] Specifically, the protection cloud captures all access behavior raw data through cloud platform service logs. The protection cloud is a centralized cloud computing platform that is responsible for centralized management, processing and storage of network security related data and policies, can coordinate various protection units, and improve network security protection capability through log analysis and behavior analysis. Cloud platform service logs are all service activity records generated in the cloud platform, usually including request, response, error, exception and other log information, used to analyze user behavior and detect security threats. The access behavior raw data of the initial access behavior is detailed information recording the access behavior, including user-initiated requests, request time, source IP, used protocols and other information.

[0042] From the access behavior raw data, access spatiotemporal features, access protocol features and device fingerprint features are extracted. Access spatiotemporal features are the spatial and temporal performance of the initial access behavior, including the geographical location and time distribution of the initial access behavior. Access protocol features are the protocol types and protocol characteristics used by the initial access behavior, such as the types of HTTP, HTTPS, FTP and other protocols, request methods (GET, POST, etc.), and whether to use encrypted transmission, etc. Device fingerprint features are a set of features used to uniquely identify a device, based on the device's hardware and software environment, usually including device model, operating system, browser type, screen resolution and other information. Device fingerprint can identify multiple accesses of the same device.

[0043] Taking the initial access behavior as the starting point, the derived operation association is performed, i.e. further operations associated with the initial access behavior, such as file download, data query, identity verification request, etc. The operations in the derived operation set are modeled to generate a behavior chain, i.e. the logical relationship between a series of operations, and the behavior sequence feature is output. Behavior chain modeling is used to understand the sequence and pattern of user behavior, so as to identify potential abnormal behavior. The behavior sequence feature is a feature sequence of user behavior generated by behavior chain modeling, which describes the time sequence, type and relationship of user operations, and helps to analyze behavior patterns.

[0044] The behavior sequence feature, access spatiotemporal feature, access protocol feature and device fingerprint feature are normalized to form a multi-dimensional behavior feature vector. For example, the spatiotemporal feature normalizes the access time to the number of hours in a day, such as 10:00 AM normalized to 0.42; the protocol feature converts different protocols into numerical labels, such as HTTP as 1 and HTTPS as 2; the device fingerprint feature converts device features such as operating system and browser into corresponding numerical values, such as 1 for Windows 10 operating system; the behavior sequence feature login, query, download, assuming login = 1, query = 2, download = 3, is converted to [1, 2, 3]. By extracting and integrating the user's spatiotemporal, protocol, device and behavior sequence features, the user's access behavior is comprehensively understood, and potential abnormal patterns are identified.

[0045] According to the multi-dimensional behavior feature vector, a pruning logic matrix is constructed, mapping pruning of the hierarchical strategy association tree is performed, and an active state protection strategy tree is generated.

[0046] Further, the application further includes the following steps: pre-constructing a strategy attribute disabling rule library and a resource object access restriction rule library; separating the multi-dimensional behavior feature vector to obtain an attribute association feature vector and a resource operation association feature vector, wherein the attribute association feature vector is composed of access space-time features and access protocol features, and the resource operation association feature vector is composed of behavior sequence features and device fingerprint features; using the attribute association feature vector to match the output of a forbidden attribute set in the strategy attribute disabling rule library; using the resource operation association feature vector to match the output of a forbidden object set in the resource object access restriction rule library; after the forbidden attribute set and the forbidden object set are coded into a forbidden identification mapping table, the pruning logic matrix is constructed in combination with the multi-dimensional behavior feature vector; and based on the pruning logic matrix, forbidden driven pruning is performed on the hierarchical strategy association tree to generate the active state protection strategy tree.

[0047] Further, the application further includes the following steps: using the pruning logic matrix to traverse the strategy attributes of each strategy node in the hierarchical strategy association tree to perform forbidden node identification pruning and generate an initial pruning strategy tree; in the initial pruning strategy tree, the associated edge weight of the pruning node is transferred by adjacent cross-level active nodes to repair the dependence relationship of the pruning node, and the active state protection strategy tree is output.

[0048] Specifically, according to the multi-level network security protection strategy of all security devices and network access permissions, a strategy attribute disabling rule library and a resource object access restriction rule library are constructed. The strategy attribute disabling rule library is a database storing strategy attributes, which contains various disabled attribute rules, and is usually set based on different features of access behaviors, such as access in certain periods, use of certain protocols, etc. If the access behavior meets these rules, it will be disabled. The resource object access restriction rule library is a database storing access restriction rules, which contains rules for restricting access to certain resources. For example, certain resources can only be accessed under certain conditions, or certain devices, IP addresses or user roles cannot access certain specific resources.

[0049] By separating the multi-dimensional behavioral feature vectors, we obtain attribute-related feature vectors and resource operation-related feature vectors. The attribute-related feature vectors consist of access spatiotemporal features and access protocol features, while the resource operation-related feature vectors consist of behavioral sequence features and device fingerprint features. In other words, the access spatiotemporal features and access protocol features of the multi-dimensional behavioral feature vectors are divided into attribute-related feature vectors, which contain feature vectors related to attributes; and the behavioral sequence features and device fingerprint features are divided into resource operation-related feature vectors, which contain feature vectors related to resource operations.

[0050] By using attribute-associated feature vectors, rules are matched against those in the policy attribute disabling rule base to obtain a set of prohibited attributes. For example, if a user accesses a system during prohibited times, such as 10 PM to 6 AM, this behavior will be added to the prohibited attribute set. The prohibited attribute set is a collection obtained by matching attribute-associated feature vectors with rules in the policy attribute disabling rule base. If an attribute, such as a time period or access protocol, violates a disabling rule, it will be added to the prohibited attribute set.

[0051] Resource operation association feature vectors are used to match rules in a resource object access restriction rule base to obtain a prohibited object set. For example, if a device fingerprint indicates that a user's device is an untrusted device, such as an unknown IP address or operating system, then access requests for that device will be added to the prohibited object set. The prohibited object set is a collection obtained by matching resource operation association feature vectors with rules in the resource object access restriction rule base. If a resource or object, such as a file or database, violates an access restriction rule, it will be added to the prohibited object set.

[0052] After encoding the obtained sets of taboo attributes and taboo objects, a taboo identifier mapping table is generated, identifying which attributes and resource objects are disabled or restricted from access. For example, the taboo attribute set includes: access protocol HTTP, access time period 10:00 PM to 6:00 AM, and device fingerprint Android; the taboo object set includes: file database restricted to Android devices, and sensitive resources restricted to intranet devices only. The taboo attributes and taboo objects are encoded into an identifier mapping table, such as: taboo attribute: access protocol HTTP is identifier 001; taboo attribute access time period 10:00 PM-6:00 AM is identifier 002; taboo object device fingerprint Android is identifier 003; and taboo object resource file database is identifier 004.

[0053] After obtaining the taboo identifier mapping table and the multi-dimensional behavioral feature vector, these two are combined to construct a pruning logic matrix. The pruning logic matrix is ​​a multi-dimensional array that records the relationship between taboo identifiers and behavioral features, and uses logical operations to determine which behavioral paths need to be pruned. For example, assuming a user's behavioral feature vector is: access time 11:00 PM, protocol HTTPS, device Android, resource access file database, the mapping is as follows: access time 11:00 PM falls within a taboo period, violating taboo rules, identifier 002; protocol HTTPS does not violate any taboo rules; device Android violates taboo rules, identifier 003; resource access file database violates access restriction rules, identifier 004; based on these relationships, the pruning logic matrix judges the behavioral path through the corresponding identifier, thereby determining whether the path should be pruned.

[0054] The pruning logic matrix prunes behavioral paths based on the matching of taboo markers. If a user's behavior matches a taboo marker, the path is pruned. The pruning logic matrix is ​​a matrix structure built on a taboo marker mapping table and multi-dimensional behavioral feature vectors. It is used to prune policy trees or behavioral paths, removing behavioral paths or policies related to taboo attributes or objects, thus optimizing the execution efficiency of the entire security policy. Through logical judgments and numerical weights, the pruning logic matrix helps filter out high-risk behavioral paths and makes blocking decisions.

[0055] Using a pruning logic matrix, each policy node in the hierarchical policy association tree is traversed. Each policy node represents a security policy unit, containing policy attributes and relationships with other policy nodes. The policy attributes of each policy node are examined according to the pruning logic matrix to identify taboo nodes. These taboo nodes violate certain security rules or do not conform to the current protection policy. Taboo node identification and pruning refers to removing policy nodes associated with behaviors or resources that do not meet security requirements, preventing erroneous execution or unsafe operations. The initial pruned policy tree is the policy tree obtained after taboo node identification and pruning operations. It contains the remaining policies and dependencies after removing non-compliant nodes, resulting in an optimized and more streamlined protection policy tree.

[0056] During pruning, the deletion of some nodes may disrupt existing dependencies. For example, a node's dependency chain might point to a pruned node, affecting the execution order or functionality of other nodes. In the initial pruning strategy tree, the weights of the associated edges of pruned nodes are transferred through adjacent cross-level active nodes. This means the functionality and dependencies of the pruned node are transferred to its adjacent active nodes, ensuring the strategy tree maintains effective protection capabilities even after some nodes are removed. Adjacent cross-level active node inheritance means that during pruning, adjacent cross-level nodes inherit the functionality of pruned strategy nodes, ensuring the continuity of the overall strategy and that dependencies remain unaffected. Through node integration and transfer, other nodes in the strategy tree can continue to perform their intended security protection tasks even after the loss of some nodes. For example, suppose a pruned node X (weight 0.8) has three predecessor nodes A, B, and C, and two successor nodes Y and Z. The weight inheritance and transfer algorithm distributes node X's weight of 0.8 to its outgoing edges according to the original weight ratio of its incoming edges, thereby increasing the weights of subsequent nodes Y and Z. The weight of node Y is increased from 0.5 to 0.7, and the weight of node Z is increased from 0.6 to 0.9, ensuring that the risk assessment is not lost due to pruning, but is focused on the remaining key nodes. The final output is a highly concise active-state protection strategy tree containing only 15,000 nodes with reasonable weight relationships. The entire pruning and repair process is completed within 200 milliseconds.

[0057] The policy tree, after inheritance, transfer, and dependency repair, becomes an active protection policy tree. This tree offers greater flexibility and targeting, dynamically activating relevant protection policies based on current access behavior and network status to provide real-time, precise protection. Tabu-driven pruning automatically removes invalid policy nodes, making the protection policy tree more streamlined and improving protection efficiency. By identifying non-compliant behaviors and resources as taboo attributes and objects, the execution of invalid policies is avoided, reducing waste of system resources.

[0058] Furthermore, this application also includes the following steps: according to the hierarchical level of the policy nodes in the hierarchical policy association tree, the multi-level atomic policy attributes are back-injected into the hierarchical policy association tree to supplement the policy node attributes.

[0059] Specifically, based on the hierarchical level of the policy nodes in the hierarchical policy association tree, i.e., the level to which each policy node belongs, multi-level atomic policy attributes are back-injected into the hierarchical policy association tree to supplement the policy node attributes. This is because policy nodes at certain levels may need to supplement their attributes based on information from higher or lower levels; therefore, back-injection is performed. For each policy node in the policy tree, relevant atomic policy attributes are back-injected based on its hierarchical level, ensuring that each policy node has complete execution conditions according to its level and the context of its associated nodes. For example, network bandwidth and access frequency are injected into policy nodes at the network layer, while user behavior and access requests may be injected into application layer nodes. After back-injecting atomic policy attributes, each policy node in the hierarchical policy association tree is supplemented with the necessary attribute information, enabling each node to accurately execute its intended function and respond to more granular protection requirements.

[0060] The protection cloud, based on the active protection policy tree, distributes atomic protection policy units layer by layer to perform hierarchical risk verification on the accessing user, generating a hierarchical risk quantification tree.

[0061] Furthermore, this application also includes the following steps: allocating heterogeneous computing resources according to the policy node types of the active protection policy tree, and outputting a multi-layer resource allocation mapping table; the protection cloud, using the multi-layer resource allocation mapping table as a dynamic scheduling constraint, and according to the active protection policy tree, issuing atomic protection policy units layer by layer to perform layered interception verification on the accessing user, generating multi-layer risk quantification data; parsing the node verification dependency order according to the topological hierarchical dependency relationship of the active protection policy tree, and outputting a hierarchical verification task queue; and performing risk transmission attenuation compensation between the layers of the multi-layer risk quantification data according to the hierarchical verification task queue, and outputting the hierarchical risk quantification tree.

[0062] Specifically, heterogeneous computing resources are allocated based on the policy node types in the active protection policy tree. Each protection node type has different computing requirements, which are allocated according to the nature and needs of the task. For different types of protection tasks, the most suitable computing resources are allocated based on their computing needs. Through heterogeneous computing resource allocation, a multi-layered resource allocation mapping table is obtained, listing the types of computing resources required by each protection node. For example, physical layer nodes may require strong network bandwidth and memory resources, while application layer nodes may rely more on CPU and database query capabilities.

[0063] The cloud-based protection system dynamically schedules computing resources based on a multi-layered resource allocation mapping table. It automatically allocates appropriate computing resources and initiates corresponding protection tasks according to the resource requirements of each node. For each protection task, optimal scheduling of network, computing, and storage resources ensures efficient execution of each protection node. The dynamic scheduling constraint, based on the multi-layered resource allocation mapping table and the computing requirements of protection nodes in the protection policy tree, ensures that appropriate computing resources are allocated to each protection task to optimize the overall system performance and response time.

[0064] Using a multi-layered resource allocation mapping table as a dynamic scheduling constraint, atomic protection policy units are distributed layer by layer in the active protection policy tree according to their hierarchical relationship, executing layered verification for accessing users. For example, the physical and network layers may perform network intrusion detection and firewall control, while the application layer may perform authentication and behavioral analysis. The verification result of each layer affects the verification decisions of subsequent layers. Based on the needs and policy objectives of different layers, the verification policy of each layer is dynamically adjusted, and each layer will intercept and verify different risk factors (such as authentication, behavioral analysis, and access control) to ensure security.

[0065] Each layer of verification tasks generates multi-layer risk quantification data, representing the risk level at that layer. For example, a successful physical layer verification might result in a risk value of 0, while an anomaly at the network layer could increase the risk value. Multi-layer risk quantification data is generated based on the verification results after each layer performs interception verification, representing the risk level of each access request.

[0066] The topological hierarchy of the active protection policy tree determines the dependency order between nodes. By parsing the structure of the protection policy tree, the prerequisite nodes that each node needs to depend on during the verification process are identified, thus forming the node verification dependency order. The node verification dependency order refers to determining the execution order of verification tasks based on the dependencies between nodes in the tree. For example, the authentication layer must be executed before the application layer's permission checks.

[0067] A hierarchical verification task queue is determined based on the parsed node verification dependency order. This queue is generated according to the topological hierarchy of the active protection policy tree, following the verification order and hierarchical structure of the nodes. Each task corresponds to a node in the tree, and the execution order is determined by the dependencies between nodes. Through the hierarchical verification task queue, protection verification at each level is executed sequentially. For example, between authentication and behavioral analysis tasks, authentication takes precedence over behavioral analysis because behavioral analysis depends on the result of authentication. In this case, the order of the hierarchical verification task queue is authentication → behavioral analysis. When tasks in the queue are executed, verification is performed layer by layer, ensuring that the verification result at each layer influences the decisions of subsequent layers.

[0068] During the execution of verification tasks, the inter-layer risk propagation attenuation compensation mechanism takes effect. Based on the verification results of each layer, risk data is propagated to the next layer, and the propagated risk data is attenuated or compensated. For example, suppose the security verification risk value of the network layer is 0.7, and the behavioral analysis risk of the application layer is 0.5. If the network layer verification passes, the risk of the application layer may be attenuated due to the absence of intrusion, and the risk value propagated to the application layer may decrease to 0.3. The risk value propagated at each layer is adjusted based on the verification results to ensure a more accurate overall risk assessment. During the execution of the hierarchical verification task queue, risk data is propagated based on the verification results of each layer. Inter-layer risk propagation attenuation compensation adjusts the risk impact of each layer by attenuating and compensating for the risk propagation process between layers, preventing anomalies at one layer from causing excessively high global risk. The hierarchical risk quantification tree is a tree structure generated based on the execution results of each layer's verification task and its risk propagation attenuation compensation process. The risk quantification value of each node reflects the security risk level of that layer, and the final hierarchical risk quantification tree is used to assess the overall security posture.

[0069] For example, suppose in a specific network security protection scenario, the system's protection layers include the physical layer, network layer, application layer, and identity layer. The risk data for each layer is as follows: Physical layer verification risk value 0.2, low risk, because there are no anomalies in the network layer; Network layer verification risk value 0.6, signs of network attack, some risk exists; Risk is passed to the application layer 0.6, because the network layer failed, the risk is passed to the next level; Application layer verification risk value 0.4, after passing the application layer's permission verification, the risk value is reduced; Risk is passed to the identity layer 0.2, the application layer verification passed, the lower risk is passed to the next level; Identity layer verification risk value 0.1, authentication successful, ultimately reducing the risk. Finally, the generated hierarchical risk quantification tree is: Physical layer 0.2, Network layer 0.6, Application layer 0.4, Identity layer 0.1. The final result of the hierarchical risk quantification tree is 0.1, indicating that through multi-layer verification and attenuation compensation, the overall risk is effectively controlled.

[0070] By dynamically allocating heterogeneous computing resources, resources are rationally allocated according to the computing needs of each protection node, thereby improving resource utilization. Dynamic scheduling constraints and hierarchical verification task queues ensure that protection tasks are executed in a hierarchical order, thus improving execution efficiency and reducing unnecessary computation.

[0071] The hierarchical risk quantification tree is subjected to nonlinear risk integration based on the time decay rule, and a dynamic risk assessment value is output.

[0072] Furthermore, this application also includes the following steps: traversing the node-related edge weights of the hierarchical risk quantification tree, performing dynamic aggregation calculation of node risk values, and outputting the node weighted aggregation result; performing nonlinear risk integral of the node weighted aggregation result based on the time decay rule, and outputting the dynamic risk evaluation value.

[0073] Specifically, the entire hierarchical risk quantization tree is traversed, and the weight of the edges associated with each node is obtained. Each edge is assigned a weight value, which represents the strength of risk transmission from one node to another. A high weight value indicates strong risk transmission, while a low weight value indicates weak risk transmission. For example, assuming that in a simplified hierarchical risk quantization tree, the risk quantization value of the network layer is 0.6, the risk quantization value of the application layer is 0.4, and the weight of the edges associated with them is 0.8, these values ​​are combined to calculate the final risk of each node.

[0074] During the traversal of each node, the node risk value is dynamically aggregated and calculated based on the weights of the associated edges. For example, if a node has a high risk value and is strongly associated with multiple other nodes (i.e., has a high weight), then the risk of that node will have a greater impact on its related nodes. For instance, assuming the application layer node risk value is 0.4, the network layer node risk value is 0.6, and the weight of the associated edge between them is 0.8, then the final risk value of the application layer = 0.4 + 0.6 × 0.8 = 0.88. After the dynamic aggregation calculation, a weighted aggregation result is generated for each node, namely the node weighted aggregation result, which combines the node's risk value and the weights of its associated edges with other nodes, representing the node's overall risk influence.

[0075] The time decay rule is used to model the time factor, typically showing that the impact of related risks gradually weakens over time. Based on the risk situation in different time periods, the node risk value is decayed, reflecting the characteristic of risk value decreasing over time. According to the time decay rule, a nonlinear risk integral is applied to the weighted aggregation result of nodes. As time progresses, the impact of earlier risks gradually weakens, and risk weighting is performed according to the time decay model. For example, the risk of a certain node may have been high in the past, but its impact will decrease over time. Assuming the risk of the physical layer is 0.2 and the risk of the application layer is 0.76, and their risk decay coefficients are 0.9 and 0.7 respectively, through time decay, the final risk values ​​of the application layer and the physical layer will be reduced to: physical layer 0.2 × 0.9 = 0.18; application layer 0.76 × 0.7 = 0.532.

[0076] Based on the weighted aggregation results of all nodes and the nonlinear integral value after time decay, a dynamic risk assessment value is calculated, representing the overall risk level and serving as a key indicator for evaluating the current security status. The dynamic risk assessment value comprehensively considers the risk impact of each node in the hierarchical risk quantification tree and provides a final system risk assessment value through time decay and nonlinear integration. By using node-weighted aggregation calculations and time decay rules, the risk impact at different levels is accurately assessed, and the risk assessment is adjusted according to time decay, avoiding the impact of outdated information. Nonlinear risk integration and dynamic aggregation calculations ensure that the system can respond in real time to changes in network attacks or security events, improving the timeliness of protection strategies.

[0077] If the dynamic risk assessment value does not meet the preset security threshold, a dynamic circuit breaker protection tag is assigned to the access ID of the accessing user.

[0078] Specifically, a preset security threshold is a fixed standard value. When the dynamic risk assessment value exceeds or falls below this value, different security protection measures will be taken. The preset security threshold is usually set based on security requirements, network environment, and historical data.

[0079] If the dynamic risk assessment value does not meet the preset security threshold, the current network security status is considered poor, and further protective measures are required. This triggers the dynamic circuit breaker protection tag, which restricts or disconnects the user accessing the system. For example, if the preset security threshold is 0.6 and the current dynamic risk assessment value is 0.5476, it means the risk is below the preset security threshold; therefore, the circuit breaker mechanism is activated, temporarily blocking the user's session.

[0080] In summary, the cloud computing-based multi-layered network security protection method provided in this application has the following beneficial effects: by integrating multi-layered network security protection strategies and constructing a hierarchical network security policy tree, the policy tree is pruned and activated based on the user's initial behavior. User risk is dynamically scored based on the user's verification results at each level of the pruned policy tree. This ensures that even if all protection layers are breached, the user is not presumed to be a safe user, continuously assessing user security, preventing premature release of potential threats, and adjusting protection strategies in a timely manner according to changes in risk, thereby improving the real-time performance and efficiency of overall network security protection.

[0081] Example 2: Based on the same inventive concept as the cloud-based multi-layered network security protection method in Example 1, this application also provides a cloud-based multi-layered network security protection system. Please refer to the appendix. Figure 2 The cloud-based multi-layered network security protection system includes:

[0082] The system comprises the following modules: an atomization decomposition module 11, used to atomize the hierarchical strategy to obtain multi-level atomic protection strategy units; a cross-level association module 12, used to perform cross-level association on the multi-level atomic protection strategy units based on strategy dependencies to construct a hierarchical strategy association tree; a dimensional feature extraction module 13, used to extract behavioral dimensional features based on the initial access behavior of the user received by the protection cloud, and output a multi-dimensional behavioral feature vector; a mapping pruning module 14, used to construct a pruning logic matrix based on the multi-dimensional behavioral feature vector, perform mapping pruning on the hierarchical strategy association tree, and generate an active protection strategy tree; a risk verification module 15, used by the protection cloud to perform layered risk verification on the user by issuing atomic protection strategy units layer by layer based on the active protection strategy tree, and generate a hierarchical risk quantification tree; a risk integration module 16, used to perform nonlinear risk integration on the hierarchical risk quantification tree based on time decay rules, and output a dynamic risk evaluation value; and a tag-based circuit breaker module 17, used to assign a dynamic circuit breaker protection tag to the user's access ID if the dynamic risk evaluation value does not meet a preset security threshold.

[0083] Furthermore, the cross-level association module 12 in the cloud-based multi-layer network security protection system is also used for: performing hierarchical classification on the multi-layer atomic protection strategy units, mapping them to a preset protection layer set, the preset protection layer set including the physical layer, virtualization layer, network layer, identity layer, application layer, data layer, and monitoring layer; enumerating the cross-level association paths of the multi-layer atomic protection strategy units based on the topological relationship of the preset protection layer set, obtaining P cross-level strategy unit combinations; retrieving the P association dependency strength values ​​of the P cross-level strategy unit combinations via network connection; traversing the P association dependency strength values ​​based on a preset dependency strength threshold, and selecting M cross-level strategy unit combinations from the P cross-level strategy unit combinations; performing cross-level association on the multi-layer atomic protection strategy units according to the M cross-level strategy unit combinations, constructing the hierarchical strategy association tree; and performing dynamic association strength weighting on the node association edges of the hierarchical strategy association tree according to the M association dependency strength values ​​of the M cross-level strategy unit combinations.

[0084] Furthermore, the cross-level association module 12 in the cloud-based multi-layered network security protection system is also used to: identify the multi-layered atomic protection strategy unit by policy attributes to obtain the multi-layered atomic policy attributes of the multi-layered atomic protection strategy unit, wherein the atomic policy attributes include policy type and target; retrieve P cross-level policy attribute combinations from the multi-layered atomic policy attributes based on the P cross-level policy unit combinations; and use the P cross-level policy unit combinations and the P cross-level policy attribute combinations as joint query features to retrieve the P association dependency strength values ​​via network connection.

[0085] Furthermore, the dimensional feature extraction module 13 in the cloud-based multi-layered network security protection system is also used for: capturing the original access behavior data of the initial access behavior through cloud platform service logs; extracting access spatiotemporal features, access protocol features, and device fingerprint features based on the original access behavior data; performing derivative operation associations starting from the initial access behavior to generate a derivative operation set; performing behavior chain modeling on the derivative operation set to output behavior sequence features; and generating the multi-dimensional behavior feature vector by normalizing the behavior sequence features, access spatiotemporal features, access protocol features, and device fingerprint features.

[0086] Furthermore, the mapping and pruning module 14 in the cloud-based multi-layered network security protection system is also used for: pre-building a policy attribute disabling rule base and a resource object access restriction rule base; separating the multi-dimensional behavioral feature vector to obtain attribute association feature vector and resource operation association feature vector, wherein the attribute association feature vector is composed of access spatiotemporal features and access protocol features, and the resource operation association feature vector is composed of behavioral sequence features and device fingerprint features; using the attribute association feature vector to match and output a set of taboo attributes in the policy attribute disabling rule base; using the resource operation association feature vector to match and output a set of taboo objects in the resource object access restriction rule base; encoding the set of taboo attributes and the set of taboo objects into a taboo identifier mapping table, and then constructing the pruning logic matrix in combination with the multi-dimensional behavioral feature vector; performing taboo-driven pruning on the hierarchical policy association tree based on the pruning logic matrix to generate the active protection policy tree.

[0087] Furthermore, the mapping pruning module 14 in the cloud-based multi-layered network security protection system is also used to: traverse the policy attributes of each policy node in the hierarchical policy association tree using the pruning logic matrix, perform taboo node identification pruning, and generate an initial pruning policy tree; in the initial pruning policy tree, repair the dependency relationship of the pruning nodes by performing adjacent cross-level active node inheritance transfer on the associated edge weights of the pruning nodes, and output the active protection policy tree.

[0088] Furthermore, the mapping and pruning module 14 in the cloud computing-based multi-layer network security protection system is also used to: inject the multi-layer atomic policy attributes back into the hierarchical policy association tree to supplement the policy node attributes according to the hierarchical level of the policy node in the hierarchical policy association tree.

[0089] Furthermore, the risk verification module 15 in the cloud-based multi-layered network security protection system is also used for: allocating heterogeneous computing resources according to the policy node type of the active protection policy tree, and outputting a multi-layer resource allocation mapping table; the protection cloud uses the multi-layer resource allocation mapping table as a dynamic scheduling constraint, and according to the active protection policy tree, distributes atomic protection policy units layer by layer to perform layered interception verification on the accessing user, generating multi-layered risk quantification data; according to the topological hierarchical dependency relationship of the active protection policy tree, parses the node verification dependency order, and outputs a hierarchical verification task queue; according to the hierarchical verification task queue, performs risk transmission attenuation compensation between the layers of the multi-layered risk quantification data, and outputs the hierarchical risk quantification tree.

[0090] Furthermore, the risk integration module 16 in the cloud-based multi-layered network security protection system is also used to: traverse the node association edge weights of the hierarchical risk quantification tree, perform dynamic aggregation calculation of node risk values, and output the node weighted aggregation result; perform nonlinear risk integration of the node weighted aggregation result based on the time decay rule, and output the dynamic risk evaluation value.

[0091] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Figure 1 The cloud-based multi-layered network security protection method and specific examples in Embodiment 1 are also applicable to the cloud-based multi-layered network security protection system in this embodiment. Through the foregoing detailed description of the cloud-based multi-layered network security protection method, those skilled in the art can clearly understand the cloud-based multi-layered network security protection system in this embodiment. Therefore, for the sake of brevity, it will not be described in detail here.

[0092] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0093] Obviously, those skilled in the art can make several improvements and modifications to this application without departing from the principles of this application, and these improvements and modifications also fall within the protection scope of this application.

Claims

1. A multi-layered network security protection method based on cloud computing, characterized in that, include: Atomize the hierarchical strategy to obtain a multi-level atomic protection strategy unit; Based on policy dependencies, cross-level associations are performed on the multi-level atomic protection policy units to construct a hierarchical policy association tree; After receiving the initial access behavior of the user, the protection cloud extracts behavioral dimension features based on the initial access behavior and outputs a multi-dimensional behavioral feature vector. Based on the multi-dimensional behavioral feature vector, a pruning logic matrix is ​​constructed, and the mapping pruning of the hierarchical policy association tree is performed to generate an active state protection policy tree; Based on the active state protection strategy tree, the protection cloud layer sends atomic protection strategy units down layer by layer to perform hierarchical risk verification on the accessing user and generate a hierarchical risk quantification tree. Based on the time decay rule, a nonlinear risk integral is performed on the hierarchical risk quantification tree to output a dynamic risk evaluation value. If the dynamic risk assessment value does not meet the preset security threshold, a dynamic circuit breaker protection tag is assigned to the access ID of the accessing user. Based on policy dependencies, cross-level associations are performed on the multi-level atomic protection policy units to construct a hierarchical policy association tree. The method includes: The multi-layer atomic protection strategy unit is hierarchically assigned and mapped to a preset protection layer set, which includes the physical layer, virtualization layer, network layer, identity layer, application layer, data layer, and monitoring layer. Based on the topological relationship of the preset protection level set, the cross-level association path of the multi-level atomic protection strategy unit is enumerated to obtain P cross-level strategy unit combinations. Retrieve P correlation dependency strength values ​​of the P cross-level strategy unit combinations via network connection; Based on a preset dependency strength threshold, the P associated dependency strength values ​​are traversed, and M cross-level strategy unit combinations are selected from the P cross-level strategy unit combinations. Based on the combination of the M cross-level strategy units, cross-level association is performed on the multi-level atomic protection strategy units to construct the hierarchical strategy association tree; Based on the M association dependency strength values ​​of the M cross-level strategy unit combinations, dynamic association strength weighting is applied to the node association edges of the hierarchical strategy association tree. Based on the multi-dimensional behavioral feature vector, a pruning logic matrix is ​​constructed, and mapping pruning of the hierarchical policy association tree is performed to generate an active-state protection policy tree. The method includes: Pre-built policy attributes disable rule bases and resource object access restriction rule bases; The multi-dimensional behavioral feature vector is separated to obtain an attribute association feature vector and a resource operation association feature vector. The attribute association feature vector is composed of access spatiotemporal features and access protocol features, and the resource operation association feature vector is composed of behavioral sequence features and device fingerprint features. The attribute-related feature vector is used to match and output a set of prohibited attributes in the policy attribute disabling rule base; The resource operation association feature vector is used to match and output a set of prohibited objects in the resource object access restriction rule base; After encoding the taboo attribute set and taboo object set into a taboo identifier mapping table, the pruning logic matrix is ​​constructed by combining the multi-dimensional behavioral feature vector. Based on the pruning logic matrix, tabu-driven pruning is performed on the hierarchical policy association tree to generate the active-state protection policy tree; The protection cloud, based on the active-state protection policy tree, distributes atomic protection policy units layer by layer to perform hierarchical risk verification on the accessing user, generating a hierarchical risk quantification tree. The method includes: Based on the policy node type of the active state protection policy tree, heterogeneous computing resources are allocated, and a multi-layer resource allocation mapping table is output. The protection cloud uses the multi-layer resource allocation mapping table as a dynamic scheduling constraint, and according to the active protection strategy tree, it distributes atomic protection strategy units layer by layer to perform layered interception and verification on the accessing user, generating multi-layer risk quantification data. Based on the topological hierarchy dependency relationship of the active state protection strategy tree, the node verification dependency order is parsed and a hierarchical verification task queue is output. Based on the hierarchical verification task queue, risk transmission attenuation compensation is performed between the hierarchical levels of the multi-level risk quantification data, and the hierarchical risk quantification tree is output.

2. The multi-layered network security protection method based on cloud computing as described in claim 1, characterized in that, After receiving the initial access behavior of a user, the protection cloud performs behavioral feature extraction based on the initial access behavior and outputs a multi-dimensional behavioral feature vector. The method includes: The protection cloud captures the original access behavior data of the initial access behavior through the cloud platform service logs; Based on the raw data of the access behavior, access spatiotemporal features, access protocol features, and device fingerprint features are extracted; Starting from the initial access behavior, derivative operations are associated to generate a set of derivative operations; Perform behavior chain modeling on the derived operation set and output behavior sequence features; The multi-dimensional behavior feature vector is generated by normalizing the behavior sequence features, access spatiotemporal features, access protocol features, and device fingerprint features.

3. The multi-layered network security protection method based on cloud computing as described in claim 1, characterized in that, Based on the pruning logic matrix, tabu-driven pruning is performed on the hierarchical policy association tree to generate the active-state protection policy tree. The method includes: The pruning logic matrix is ​​used to traverse the policy attributes of each policy node in the hierarchical policy association tree, and taboo node identification and pruning are performed to generate an initial pruning policy tree. In the initial pruning strategy tree, the dependency relationship of the pruning nodes is repaired by transferring the weight of the associated edges of the pruning nodes to adjacent cross-level active nodes, and the active state protection strategy tree is output.

4. The multi-layered network security protection method based on cloud computing as described in claim 2, characterized in that, The method of retrieving P correlation dependency strength values ​​of the P cross-level policy unit combinations via network connection includes: The multi-level atomic protection strategy unit is identified by strategy attribute identification to obtain the multi-level atomic strategy attribute of the multi-level atomic protection strategy unit, wherein the atomic strategy attribute includes strategy type and target. Based on the P cross-level strategy unit combinations, P cross-level strategy attribute combinations are retrieved from the multi-level atomic strategy attributes; The P cross-level strategy unit combinations and P cross-level strategy attribute combinations are used as joint query features to retrieve the P association dependency strength values ​​via network connection.

5. The multi-layered network security protection method based on cloud computing as described in claim 4, characterized in that, Based on the hierarchical level of the strategy nodes in the hierarchical strategy association tree, the multi-level atomic strategy attributes are back-injected into the hierarchical strategy association tree to supplement the strategy node attributes.

6. The multi-layered network security protection method based on cloud computing as described in claim 1, characterized in that, The method involves performing a nonlinear risk integral on the hierarchical risk quantification tree based on a time decay rule to output a dynamic risk assessment value. Traverse the node-associated edge weights of the risk quantification tree at the specified level, perform dynamic aggregation calculation of node risk values, and output the weighted aggregation result of nodes; The nonlinear risk integral of the node weighted aggregation result is calculated based on the time decay rule, and the dynamic risk assessment value is output.

7. A multi-layered network security protection system based on cloud computing, characterized in that, The step of implementing the cloud-based multi-layered network security protection method according to any one of claims 1 to 6, wherein the cloud-based multi-layered network security protection system comprises: The atomization decomposition module is used to atomize hierarchical strategies to obtain multi-level atomic protection strategy units. The cross-level association module is used to perform cross-level association on the multi-level atomic protection strategy units based on policy dependencies, and construct a hierarchical policy association tree. The dimension feature extraction module is used to extract behavioral dimension features based on the initial access behavior of the user after the cloud receives the initial access behavior of the user, and output a multi-dimensional behavioral feature vector. The mapping and pruning module is used to construct a pruning logic matrix based on the multi-dimensional behavioral feature vector, perform mapping and pruning of the hierarchical policy association tree, and generate an active state protection policy tree. The risk verification module is used by the protection cloud to perform layered risk verification on the accessing user by issuing atomic protection policy units layer by layer according to the active protection policy tree, and to generate a hierarchical risk quantification tree. The risk integration module is used to perform nonlinear risk integration on the hierarchical risk quantification tree based on the time decay rule and output a dynamic risk evaluation value. The tag-based circuit breaker module is used to assign a dynamic circuit breaker protection tag to the access ID of the accessing user if the dynamic risk assessment value does not meet the preset security threshold. Furthermore, the cross-level association module is also used for: performing hierarchical classification on the multi-level atomic protection strategy units, mapping them to a preset protection level set, the preset protection level set including the physical layer, virtualization layer, network layer, identity layer, application layer, data layer, and monitoring layer; based on the topological relationship of the preset protection level set, enumerating the cross-level association paths of the multi-level atomic protection strategy units to obtain P cross-level strategy unit combinations; retrieving the P association dependency strength values ​​of the P cross-level strategy unit combinations via network connection; traversing the P association dependency strength values ​​based on a preset dependency strength threshold, and selecting M cross-level strategy unit combinations from the P cross-level strategy unit combinations; performing cross-level association on the multi-level atomic protection strategy units according to the M cross-level strategy unit combinations to construct the hierarchical strategy association tree; and performing dynamic association strength weighting on the node association edges of the hierarchical strategy association tree according to the M association dependency strength values ​​of the M cross-level strategy unit combinations. Furthermore, the mapping pruning module is also used for: pre-constructing a policy attribute disabling rule base and a resource object access restriction rule base; separating the multi-dimensional behavioral feature vector to obtain an attribute association feature vector and a resource operation association feature vector, wherein the attribute association feature vector is composed of access spatiotemporal features and access protocol features, and the resource operation association feature vector is composed of behavioral sequence features and device fingerprint features; using the attribute association feature vector to match and output a set of taboo attributes in the policy attribute disabling rule base; using the resource operation association feature vector to match and output a set of taboo objects in the resource object access restriction rule base; encoding the set of taboo attributes and the set of taboo objects into a taboo identifier mapping table, and then constructing the pruning logic matrix in combination with the multi-dimensional behavioral feature vector; performing taboo-driven pruning on the hierarchical policy association tree based on the pruning logic matrix to generate the active protection policy tree; Furthermore, the risk verification module is also used for: allocating heterogeneous computing resources according to the policy node type of the active protection policy tree, and outputting a multi-layer resource allocation mapping table; the protection cloud uses the multi-layer resource allocation mapping table as a dynamic scheduling constraint, and according to the active protection policy tree, distributes atomic protection policy units layer by layer to perform layered interception verification on the accessing user, generating multi-layer risk quantification data; according to the topological hierarchical dependency relationship of the active protection policy tree, parses the node verification dependency order, and outputs a hierarchical verification task queue; according to the hierarchical verification task queue, performs risk transmission attenuation compensation between the layers of the multi-layer risk quantification data, and outputs the hierarchical risk quantification tree.

Images