Security protection method and device based on cross-cloud collaborative verification and terminal equipment

Abstract

The invention discloses a safety protection method and device based on cross-cloud cooperative verification and terminal equipment, and the method comprises the steps: collecting the safety event data of a plurality of public clouds in real time, and generating an environment threat coefficient; dynamically generating feature weight vectors of different security feature dimensions in the service data flow based on the environmental threat coefficient and the real-time response time; calculating a basic threat score based on the feature weight vector, and superposing a vulnerability compensation value calculated based on a machine learning model gradient magnitude to generate a final threat score; when the final threat score exceeds a security threshold, an antagonism test sample is generated in a sandbox environment according to a highest attack level standard, and a real-time defense strategy is generated and executed based on the test sample. The global threat situation perception and defense can be realized by constructing a ''cross-cloud dynamic scoring-sandbox game verification-model real-time feedback'' framework, and the technical problem that the information security protection system in the prior art cannot realize the perception and defense of the global threat situation is solved.

Description

Technical Field

[0001] This invention relates to the field of computers, and in particular to a security protection method, apparatus and terminal device based on cross-cloud collaborative verification. Background Technology

[0002] With the rapid development of cloud computing technology, enterprise business systems are gradually migrating from single cloud platforms to multi-cloud architectures, and cross-cloud data interaction is becoming increasingly frequent, bringing with it increasingly prominent security risks. However, most existing information security protection systems rely on security policies for a single cloud environment and lack cross-cloud platform collaborative verification capabilities. They cannot meet the needs of collaborative verification of data streams from multiple public clouds, resulting in security blind spots during cross-cloud data interaction and an inability to perceive and defend against global threats.

[0003] In summary, existing information security protection systems suffer from the technical problem of being unable to perceive and defend against a global threat landscape. Summary of the Invention

[0004] This application provides a security protection method, device, and terminal equipment based on cross-cloud collaborative verification, which solves the technical problem that existing information security protection systems cannot achieve global threat situation perception and defense.

[0005] Firstly, this application provides a security protection method based on cross-cloud collaborative verification, applicable to cross-cloud collaborative security systems, the method comprising: Real-time collection of security event data from multiple public clouds; and generation of an environmental threat coefficient for each public cloud based on the security event data. Based on the environmental threat coefficient and the real-time response time of the cross-cloud collaborative security system, feature weight vectors of data with different security feature dimensions in the business data stream are dynamically generated. The business data stream is the data transmitted between multiple public clouds and includes data with multiple different security feature dimensions. A basic threat score is calculated based on the feature weight vector. A vulnerability compensation value calculated based on the gradient magnitude of a machine learning model is then superimposed on the basic threat score to generate the final threat score of the business data stream. The machine learning model is a preset model for identifying security features of the business data stream. If the final threat score exceeds the security threshold score, an adversarial test sample is generated in the sandbox environment according to the highest attack level standard. Based on the adversarial test sample, a defense strategy for blocking the attack is generated and executed.

[0006] The step of generating an environmental threat coefficient for each of the public clouds based on the security event data includes: Based on the cloud platform identifier, the security event data of each public cloud is aggregated to obtain the number of security events for each public cloud; Obtain the total amount of global security incident data, and divide the number of security incidents in each of the public clouds by the total amount of global security incident data to obtain the environmental threat coefficient corresponding to each of the public clouds.

[0007] The step of dynamically generating feature weight vectors for data of different security feature dimensions in the business data stream based on the environmental threat coefficient and the real-time response time of the cross-cloud collaborative security system includes: The environmental threat coefficients of each of the aforementioned public clouds are weighted and summed to obtain the basic weighting factor; By combining the real-time response time of the cross-cloud collaborative security system, the basic weight factor is adjusted through an exponential decay function to obtain the dynamic weight coefficient. The dynamic weight coefficients are multiplied by predefined feature importance parameters to generate feature weight vectors for data of different security feature dimensions in the business data stream.

[0008] The calculation of the basic threat score based on the feature weight vector includes: Extract data feature values ​​corresponding to different security feature dimensions from the business data stream; The initial score is obtained by multiplying the data feature values ​​corresponding to different security feature dimensions and their corresponding feature weight vectors, and then summing the results. The initial score is mapped to a standard score range to obtain a basic threat score corresponding to the business data stream.

[0009] The step of superimposing a vulnerability compensation value calculated based on the gradient magnitude of a machine learning model onto the basic threat score to generate the final threat score of the business data stream includes: The parameter gradient matrix of the current machine learning model is obtained in real time, and the square root of the sum of squares of all elements in the parameter gradient matrix is ​​used as the gradient magnitude. Based on the gradient magnitude and compensation coefficient, the vulnerability compensation value is calculated; The base threat score is added to the vulnerability compensation value to obtain the final threat score of the business data stream.

[0010] The step of generating adversarial test samples in a sandbox environment according to the highest attack level standard, and generating and executing defense strategies to block attacks based on the adversarial test samples, includes: Based on the gradient magnitude of the machine learning model, adversarial test samples are generated according to the perturbation ratio corresponding to the highest attack level standard. By utilizing the uncovered feature combinations exposed by the adversarial test samples, and combining them with the strategy diversity enhancement coefficient, a defense strategy for blocking attacks is generated. Implement the defense strategy described above.

[0011] The process of executing the defense strategy also includes: Generate a defense strategy execution log, and convert the user identity in the defense strategy execution log into an irreversible cryptographic identifier using a homomorphic hash function; The cryptographic identifier, the gradient magnitude, and the execution log of the defense strategy are encrypted to obtain a ciphertext, which is then encapsulated into a transaction body to generate a blockchain block containing zero-knowledge proofs.

[0012] Secondly, this application provides a security protection device based on cross-cloud collaborative verification, applicable to cross-cloud collaborative security systems, the device comprising: The threat coefficient determination module is used to collect security event data from multiple public clouds in real time and generate an environmental threat coefficient for each public cloud based on the security event data. The weight vector generation module is used to dynamically generate feature weight vectors for data of different security feature dimensions in the business data stream based on the environmental threat coefficient and the real-time response time of the cross-cloud collaborative security system. The business data stream is data transmitted between multiple public clouds and includes data of various security feature dimensions. The threat score generation module is used to calculate a basic threat score based on the feature weight vector, and to superimpose a vulnerability compensation value calculated based on the gradient magnitude of a machine learning model on the basic threat score to generate the final threat score of the business data stream. The machine learning model is a preset model for identifying security features of the business data stream. The defense execution module is used to generate adversarial test samples in a sandbox environment according to the highest attack level standard when the final threat score exceeds the security threshold score, and to generate and execute defense strategies to block attacks based on the adversarial test samples.

[0013] Thirdly, this application provides a terminal device, which includes a processor and a memory; The memory is used to store computer programs and to transfer the computer programs to the processor; The processor is used to execute a security protection method based on cross-cloud collaborative verification as described in the first aspect, according to instructions in the computer program.

[0014] Fourthly, this application provides a storage medium for storing computer-executable instructions, which, when executed by a computer processor, are used to perform a security protection method based on cross-cloud collaborative verification as described in the first aspect.

[0015] This invention provides a security protection method, device, and terminal equipment based on cross-cloud collaborative verification. By introducing cloud environment threat factors to dynamically adjust feature weight vectors, this invention overcomes the difficulty of synchronizing strategies across public cloud environments, achieving multi-cloud collaborative detection. Simultaneously, the method of generating adversarial test samples based on the highest attack level standard and optimizing defense strategies can significantly shorten the dynamic response latency to new attacks. Furthermore, this invention generates a final threat score by superimposing vulnerability compensation values ​​on the basic threat score, which can integrate multi-source feature sensitivity and improve detection completeness. By constructing a "cross-cloud dynamic scoring - sandbox game verification - real-time model feedback" architecture, this invention can achieve global threat situation awareness and defense, solving the technical problem that existing information security protection systems cannot achieve global threat situation awareness and defense. Attached Figure Description

[0016] Figure 1 A flowchart of a security protection method based on cross-cloud collaborative verification provided in an embodiment of the present invention.

[0017] Figure 2 This is a schematic diagram of the framework of a cross-cloud collaborative verification security protection method provided in an embodiment of the present invention.

[0018] Figure 3 This is a schematic diagram illustrating a process for generating blockchain blocks, provided as an embodiment of the present invention.

[0019] Figure 4 This is a schematic diagram of a security protection device based on cross-cloud collaborative verification, provided in an embodiment of the present invention.

[0020] Figure 5 This is a schematic diagram of the frame of a terminal device provided in an embodiment of the present invention. Detailed Implementation

[0021] The following description and accompanying drawings fully illustrate specific embodiments of this application to enable those skilled in the art to practice them. The embodiments represent only possible variations. Individual components and functions are optional unless explicitly required, and the order of operation may vary. Parts and features of some embodiments may be included in or replace parts and features of other embodiments. The scope of embodiments of this application includes the entire scope of the claims and all available equivalents of the claims. In this document, each embodiment may be referred to individually or collectively by the term "invention," which is merely for convenience and is not intended to automatically limit the scope of the application to any single invention or inventive concept if more than one invention is disclosed. Relational terms such as "first" and "second" are used herein only to distinguish one entity or operation from another, without requiring or implying any actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed. The various embodiments in this document are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the structures, products, etc., disclosed in the embodiments, since they correspond to the disclosed parts, the descriptions are relatively simple; relevant details can be found in the method section.

[0022] With the rapid development of cloud computing technology, enterprise business systems are gradually migrating from single cloud platforms to multi-cloud architectures, and cross-cloud data interaction is becoming increasingly frequent, bringing with it increasingly prominent security risks. However, most existing information security protection systems rely on security policies for a single cloud environment and lack cross-cloud platform collaborative verification capabilities. They cannot meet the needs of collaborative verification of data streams from multiple public clouds, resulting in security blind spots during cross-cloud data interaction and an inability to perceive and defend against global threats.

[0023] Secondly, existing technologies present a trade-off between detection completeness and response speed. The WDTA framework requires coverage of all four attack strengths, but traditional DAST-AI (Dynamic Application Security Testing-AI) technology requires over 200ms of response time to alert to injection attacks. In high-frequency data interaction scenarios, this response delay can lead to serious security consequences. Furthermore, existing technologies present a trade-off between model interpretability and privacy protection. As revealed by Ant Group's "Ant Detection" solution, privacy data (such as user identity vectors) requires decryption during the feature analysis phase, violating the GDPR's (General Data Protection Regulation) principle of data minimization.

[0024] Therefore, in order to solve the above-mentioned technical problems, embodiments of the present invention provide a security protection method based on cross-cloud collaborative verification, such as... Figure 1 As shown, Figure 1 This is a flowchart illustrating a security protection method based on cross-cloud collaborative verification provided in an embodiment of the present invention. The security protection method based on cross-cloud collaborative verification provided in this embodiment is applicable to cross-cloud collaborative security systems. These systems can be implemented through software and / or hardware, and can consist of two or more physical entities, or a single physical entity. The security protection method based on cross-cloud collaborative verification provided in this embodiment includes the following steps: Step 101: Collect security event data from multiple public clouds in real time, and generate an environmental threat coefficient for each public cloud based on the security event data.

[0025] In this embodiment, the cross-cloud collaborative security system needs to collect security event data from multiple public clouds in real time. This security event data includes information related to security attacks suffered by the cloud environment. Security attack events are defined using the WDTA framework and include attack source characteristics, attack type distribution, and vulnerability exploitation when a public cloud is attacked. This data reflects the frequency and severity of security issues faced by the public cloud. After collecting security event data from each public cloud, it is necessary to further determine the environmental threat coefficient of each public cloud based on this data to quantify the security risk level of each public cloud's environment. In one embodiment, the environmental threat coefficient of each public cloud can be quantified based on the number of security events for each public cloud. Specifically, firstly, the security event data of each public cloud is aggregated based on the cloud platform identifier to obtain the number of security events for each public cloud. It can be understood that in this embodiment, each security event data carries the corresponding public cloud's cloud platform identifier, and the security event data of each public cloud can be aggregated based on the cloud platform identifier to count the number of security events for each public cloud. For example, after collecting security incident data from three public cloud platforms—AWS, Azure, and GCP—the data is aggregated based on the cloud platform identifier. The results show 320 security incidents on the AWS platform, 280 on the Azure platform, and 210 on the GCP platform. Then, the total global security incident data is obtained, and the number of security incidents for each public cloud is divided by the total global security incident data to obtain the corresponding environmental threat coefficient for each public cloud. Assuming a collection of public clouds... Based on WDTA attack classification data, the environmental threat coefficient of each public cloud. The calculation formula is as follows:

[0026] in, .

[0027] Step 102: Based on the environmental threat coefficient and the real-time response time of the cross-cloud collaborative security system, dynamically generate feature weight vectors for data of different security feature dimensions in the business data stream. The business data stream is the data transmitted between multiple public clouds and includes data of various different security feature dimensions.

[0028] In this embodiment, the business data streams transmitted between multiple public clouds include data with various security feature dimensions. For example, a business data stream may simultaneously contain three types of information: user requests, transaction data, and session metadata. The feature weight vector is assigned to data with different security feature dimensions (not data types) in the business data stream. In one embodiment, the data with different security feature dimensions in the business data stream are shown in Table 1: Table 1

[0029] After determining the environmental threat coefficients of each public cloud, it is necessary to determine the current real-time response time of the cross-cloud collaborative security system. Then, by combining the environmental threat coefficients of each public cloud with the real-time response time of the cross-cloud collaborative security system, the feature weight vectors of data in different security feature dimensions within the business data flow can be dynamically determined. It can be understood that the environmental threat coefficient reflects the risk of the public cloud environment, while the real-time response time reflects the efficiency of the cross-cloud collaborative security system in handling security events. The combined effect of both allows for a more accurate assessment of the importance and risk level of the business data flow across different security feature dimensions. Furthermore, the dynamically generated approach allows for flexible adjustment of the weights of each security feature dimension based on real-time changes in environmental threats and system response, making security protection strategies more targeted and adaptable to address constantly evolving security threats.

[0030] In one embodiment, step 102 dynamically generates feature weight vectors for data of different security feature dimensions in the business data stream based on the environmental threat coefficient and the real-time response time of the cross-cloud collaborative security system, including: Step 1021: Sum the environmental threat coefficients of each public cloud in a weighted manner to obtain the basic weight factor.

[0031] When determining the feature weight vectors of data for different security feature dimensions, it is first necessary to sum the environmental threat coefficients of each public cloud using weighted averages to determine the basic weight factors. The specific formula is shown below:

[0032] in, Based on the weighting factor, For the first i The cloud weight factor corresponding to each public cloud, This can be preset and is not specifically limited in this embodiment. For example, assuming the environmental threat coefficients of AWS cloud platform, Azure cloud platform and GCP cloud platform are 0.395, 0.346 and 0.259 respectively, and the corresponding cloud weight factors are 0.4, 0.35 and 0.25 respectively, then the basic weight factor is 0.395×0.4+0.346×0.35+0.259×0.25=0.343.

[0033] Step 1022: Combine the real-time response time of the cross-cloud collaborative security system, and adjust the basic weight factor through an exponential decay function to obtain the dynamic weight coefficient.

[0034] After determining the basic weighting factors, they need to be further adjusted based on the real-time response time of the cross-cloud collaborative security system and the exponential decay function to obtain dynamic weighting coefficients. In one embodiment, the adjustment formula is as follows:

[0035] in, For dynamic weighting coefficients, For real-time response time (must meet) ), Sigmoid steepness coefficient (taken as...) (Ensure function sensitivity). Step 1023: Multiply the dynamic weight coefficients with the predefined feature importance parameters to generate feature weight vectors for data of different security feature dimensions in the business data flow.

[0036] After determining the dynamic weight coefficients, the dynamic weight coefficients are further multiplied by the predefined feature importance parameters to generate feature weight vectors for data of different security feature dimensions in the business data stream. The specific calculation formula is as follows:

[0037] in, Let n be the feature importance parameter of the nth security feature dimension, used to quantify the nth security feature dimension. n Each security feature dimension in threat scenarios m Its crucial role. For the first n The feature weight vector of data for each security feature dimension. For example, suppose the predefined feature importance parameter vectors corresponding to operational risk level, encryption strength, geographic anomaly index, token trustworthiness, and data integrity are [0.8, 0.6, 0.9, 0.7, 0.5], and the dynamic weight coefficients... =0.236, then the feature weight vector for different security feature dimensions is [0.236×0.8, 0.236×0.6, 0.236×0.9, 0.236×0.7, 0.236×0.5]=[0.189, 0.142, 0.212, 0.165, 0.118].

[0038] Step 103: Calculate the basic threat score based on the feature weight vector, and superimpose the vulnerability compensation value calculated based on the gradient magnitude of the machine learning model on the basic threat score to generate the final threat score of the business data stream. The machine learning model is a preset model for identifying security features of the business data stream.

[0039] After determining the feature weight vectors of data for different security feature dimensions, it is necessary to further calculate the basic threat score of the business data flow based on the feature weight vectors. The basic threat score reflects the current risk level of the business data flow. In one embodiment, the basic threat score can be obtained by weighted summing of the data feature values ​​and corresponding feature weight vectors for different security feature dimensions in the business data flow.

[0040] After calculating the basic threat score, a vulnerability compensation value calculated based on the gradient magnitude of a machine learning model needs to be superimposed on it. The gradient magnitude of the machine learning model reflects its sensitivity to the security features of the business data stream and its potential vulnerabilities. This gradient magnitude is obtained by dynamically calculating the sensitivity (gradient) of the model parameters to the input business data stream. In this embodiment, the machine learning model is a pre-defined model for identifying security features of the business data stream. Existing technologies can be used, and machine learning models are widely used as pre-defined business stream security feature identifiers. The current cutting-edge approach is the fusion deployment of decryption-free Transformer architectures (such as ET-BERT) and lightweight CNNs. By calculating the vulnerability compensation value and superimposing it on the basic threat score, this embodiment can more comprehensively consider the potential security risks of the business data stream, improving the accuracy and reliability of the threat score.

[0041] Based on the above embodiments, step 103, which calculates the basic threat score based on the feature weight vector, includes: Step 1031: Extract data feature values ​​corresponding to different security feature dimensions from the business data flow.

[0042] Step 1032: Multiply the data feature values ​​corresponding to different security feature dimensions and the corresponding feature weight vectors, and then sum them to obtain the initial score.

[0043] Step 1033: Map the initial score to the standard score range to obtain the basic threat score corresponding to the business data flow.

[0044] In this embodiment, when calculating the basic threat score, it is first necessary to extract data feature values ​​corresponding to different security feature dimensions from the business data stream. These data feature values ​​are numerical indicators that quantify specific security attributes and are extracted from the business data stream through mathematical modeling. In one embodiment, the calculation method for data feature values ​​of different security feature dimensions is shown in Table 2. Table 2

[0045] For example, the data feature values ​​extracted from the business data stream corresponding to operational risk level, encryption strength, geographical anomaly index, token trustworthiness, and data integrity are [0.75, 0.62, 0.88, 0.54, 0.91]. Then, the data feature values ​​corresponding to different security feature dimensions are multiplied by their corresponding feature weight vectors and summed to obtain an initial score. For example, the initial score is 0.189×0.75+0.142×0.62+0.212×0.88+0.165×0.54+0.118×0.91=0.509. Finally, the initial score is mapped to a standard score range to obtain the basic threat score corresponding to the business data stream. Assuming the standard score range is [0, 10], the basic threat score is 0.509×10=5.09.

[0046] Based on the above embodiments, step 103, which involves superimposing a vulnerability compensation value calculated based on the gradient magnitude of a machine learning model onto the basic threat score to generate the final threat score for the business data stream, includes: Step 1034: Obtain the parameter gradient matrix of the current machine learning model in real time, and calculate the square root of the sum of squares of all elements in the parameter gradient matrix as the gradient magnitude.

[0047] Step 1035: Calculate the vulnerability compensation value based on the gradient magnitude and the compensation coefficient.

[0048] Step 1036: Add the basic threat score to the vulnerability compensation value to obtain the final threat score of the business data flow.

[0049] In this embodiment, after determining the basic threat score of the business data flow, the gradient values ​​of all parameters of the machine learning model (i.e., the change in the sensitivity of the machine learning model to the input) are obtained in real time, and a parameter gradient matrix is ​​constructed based on the gradient values ​​of all parameters. Then, each gradient value in the parameter gradient matrix is ​​squared, and all squared gradient values ​​are summed to obtain the summation result. Finally, the square root of the summation result is taken to obtain the gradient magnitude. For example, assuming the machine learning model has 3 layers of parameters with the following gradient values: first layer: [0.3, -0.2, 1.1], second layer: [0.8, 0.4, -0.6], third layer: [-0.5, 1.2, 0.1], the calculation process is as follows: Square all values ​​→ [0.09, 0.04, 1.21, 0.64, 0.16, 0.36, 0.25, 1.44, 0.01]; The sum of all the terms is: 0.09 + 0.04 + 1.21 + 0.64 + 0.16 + 0.36 + 0.25 + 1.44 + 0.01 = 4.0. Taking the square root → √4.0 = 2.0, the output gradient magnitude is 2.0.

[0050] After determining the gradient magnitude, the vulnerability compensation value is further calculated based on the gradient magnitude. Specifically, the gradient magnitude is increased by 1, and the natural logarithm is taken. The resulting logarithm is then multiplied by a preset compensation coefficient (fixed value 0.5) to obtain the vulnerability compensation value. For example, assuming the gradient magnitude is 2, the gradient magnitude is increased by 1 → 2 + 1 = 3, the natural logarithm is taken → ln(3) ≈ 1.099, and multiplied by the compensation coefficient → 1.099 × 0.5 ≈ 0.55, outputting a vulnerability compensation value of 0.55.

[0051] Finally, the base threat score is added to the vulnerability compensation value to obtain the final threat score for the business data flow.

[0052] Step 104: If the final threat score exceeds the security threshold score, generate adversarial test samples in the sandbox environment according to the highest attack level standard, and generate and execute defense strategies to block the attack based on the adversarial test samples.

[0053] After obtaining the final threat score, if the final threat score exceeds the security threshold score, security defense is required. The security threshold score can be preset according to actual needs; for example, it can be set to 5.0. When performing security defense, adversarial test samples must first be generated in a sandbox environment according to the highest attack level standard of the WDTA attack classification (WDTALevel 4). The sandbox environment is a secure and isolated operating environment where various potential attack scenarios can be safely simulated and tested without harming the actual business system. The highest attack level standard means simulating the most dangerous and complex attack methods to generate adversarial test samples, which include various characteristics and behavioral patterns of simulated attacks. By generating adversarial test samples using the highest attack level standard, the effectiveness of the defense strategy can be comprehensively verified. In one embodiment, step 104, generating adversarial test samples in the sandbox environment according to the highest attack level standard, and generating and executing a defense strategy to block the attack based on the adversarial test samples, includes: Step 1041: Based on the gradient magnitude of the machine learning model, generate adversarial test samples according to the perturbation ratio corresponding to the highest attack level standard.

[0054] First, based on the WDTA Level 4 attack standard, constrain the perturbation strength:

[0055] in, The perturbation intensity is represented by Level 2 / 4, which is the WDTA attack classification standard. The perturbation ratio corresponding to the high attack level standard is 0.1.

[0056] The specific formula for generating adversarial test samples based on the perturbation ratio corresponding to the highest attack level standard is as follows:

[0057] in, For the generated adversarial test samples, These are the data feature values ​​corresponding to different security feature dimensions. For gradient magnitude, sign() The sign function for the gradient direction (values ​​±1). For the parameters of the machine learning model, y The label is the threat level that the machine learning model expects to determine. Ideally, it can be a real threat label labeled by humans (e.g., 0=safe, 1=fraud). In unlabeled scenarios, the confidence level predicted by the machine learning model can be used as the label.

[0058] Step 1042: Utilize the combination of uncovered features exposed by the adversarial test samples, and combine them with the strategy diversity enhancement coefficient to generate a defense strategy to block attacks.

[0059] After generating adversarial test samples, these samples can be input into a pre-trained security detection model. Failure points (false positives / false negatives) in the security detection model are recorded, and the feature combinations leading to these failures are extracted, thus obtaining uncovered feature combinations. Uncovered feature combinations refer to combinations of high-risk security feature dimensions that are not effectively identified by the security detection model. For example, a high-risk feature combination could be, in a cross-border financial fraud scenario, an operational risk level of 1.2 (high-frequency abnormal operations) and a geographical anomaly index of 0.9 (high-incidence hacker areas), i.e., a high operational risk level and a high geographical anomaly index. After determining the uncovered feature combinations, a defense strategy to block attacks needs to be generated by combining the strategy diversity enhancement coefficient. For example, the objective function for strategy optimization in this embodiment is as follows:

[0060] in, To minimize the expectation, For feature combination (p, q) For the penalty items that are not covered, The entropy weighting coefficient (i.e., the strategy diversity enhancement coefficient) is taken as... (Balancing diversity and efficiency) P This represents the probability distribution of the defense strategy.

[0061] This embodiment aims to minimize the combined risk. and maximizing policy entropy For the objective, in the policy probability and Under the constraint of 1, find the probability distribution that minimizes the objective function using gradient descent or SLSQP algorithms.P* Finally according to P* The probability weights are dynamically determined to determine the defense strategy (such as a combination of rate limiting, authentication, and blocking).

[0062] Step 1043: Implement the defense strategy.

[0063] After generating a defense strategy, it can be executed to block the attack. In one embodiment, such as... Figure 2 As shown, Figure 2 This is a schematic diagram of a security protection method for cross-cloud collaborative verification provided in an embodiment of the present invention. It can be understood that if the final threat score is not greater than the security threshold score, the business data flow can be allowed.

[0064] As described above, this invention provides a cross-cloud collaborative verification security protection method. By introducing cloud environment threat factors to dynamically adjust feature weight vectors, this invention overcomes the difficulty of synchronizing strategies across public cloud environments, achieving multi-cloud collaborative detection. Simultaneously, the method of generating adversarial test samples based on the highest attack level standard and optimizing defense strategies can significantly shorten the dynamic response latency of new attacks. Furthermore, this invention generates a final threat score by superimposing vulnerability compensation values ​​on the basic threat score, which can integrate multi-source feature sensitivity and improve detection completeness. By constructing a "cross-cloud dynamic scoring - sandbox game verification - real-time model feedback" architecture, this invention can achieve global threat situation awareness and defense, solving the technical problem that existing information security protection systems cannot achieve global threat situation awareness and defense.

[0065] Based on the above embodiments, after executing the defense strategy, it also includes: Step 105: Generate a defense strategy execution log, and convert the user identity in the defense strategy execution log into an irreversible cryptographic identifier using a homomorphic hash function.

[0066] In one embodiment, after executing the defense strategy, it is also necessary to generate a defense strategy execution log based on the executed defense strategy, and parse the user identity carried in the defense strategy execution log. The user identity is a unique and traceable entity identifier recorded during the execution of the defense strategy, which is essentially the initiating entity of the business data flow. For example, user identities in different scenarios are shown in Table 3.

[0067] Table 3

[0068] After resolving the user's identity, the user's identity is converted into an irreversible cryptographic identifier using a homomorphic hash function, as shown in the following formula:

[0069] in, For the output cryptographic identifier, For user identity, s For generators, h For large prime numbers, MOD stands for Modulo operation.

[0070] Step 106: Encapsulate the ciphertext obtained by encrypting the cryptographic identifier, gradient magnitude, and defense strategy execution log into a transaction body, and generate a blockchain block containing zero-knowledge proofs.

[0071] After obtaining the cryptographic identifier, the cryptographic identifier, along with the encrypted log text of the defense strategy execution log (i.e., the encrypted defense strategy execution log) and the gradient magnitude of the machine learning model, are encapsulated into a tamper-proof data packet. This tamper-proof data packet is then uploaded to the consortium blockchain network as the transaction body, generating a blockchain block containing zero-knowledge proofs. The blockchain audit record includes a block header and transaction data. It includes the previous block hash, timestamp, and gradient magnitude, as shown below:

[0072] in The hash of the previous block. For timestamps, This represents the gradient magnitude.

[0073] Furthermore, when adding zero-knowledge proofs, mathematical credentials can be generated to prove that the security combinations already covered in the system can be verified without revealing their specific content. In one embodiment, a security coverage proof can be generated: 。

[0074] in, π Output credentials for zero-knowledge proofs ZK-SNARK To prove the generation algorithm, (p,q) For feature dimension combination, Tx_pq For the combination (p,q) Blockchain transactions, Chain This indicates that the transaction has been written to the blockchain. Uncovered This is the set of uncovered feature combinations.

[0075] For example, such as Figure 3 As shown, Figure 3 This is a schematic diagram illustrating a process for generating blockchain blocks, provided as an embodiment of the present invention.

[0076] In one embodiment, after generating a blockchain block, model risk indicators (e.g., high-risk attack sensitivity "2.0") can be read from the blockchain block, and feature importance parameters can be automatically adjusted based on the risk indicator value. For example, if the indicator shows that a certain combination of features is high-risk, the feature importance parameter of the security feature dimension corresponding to that combination will be increased.

[0077] As described above, this invention employs homomorphic hash conversion and blockchain notarization to anonymize user identities in defense strategy execution logs, achieving attack tracing while meeting privacy compliance requirements. The zero-knowledge proof verification audit chain ensures that all uncovered feature combinations are recorded, enhancing the completeness of sandbox game verification. This invention, by constructing a three-in-one architecture of cross-cloud dynamic scoring, sandbox game verification, and blockchain notarization, can improve cross-cloud threat detection coverage, reduce response latency, reduce encryption computation overhead, and meet compliance requirements. It solves the technical problem of existing information security protection systems being unable to achieve global threat situation perception and defense.

[0078] In one embodiment, the core algorithm of the technical solution implemented using Python is shown below: class AISecurityValidator: def __init__(self): # Initialize the cross-cloud dynamic scoring model self.scorer = CloudSecurityScorer() # Initialize the adversarial example generator self.validator = AdversarialValidator(attack_level=4) # Initialize the blockchain audit chain self.audit_chain = PrivacyAuditChain("private") def process_data(self, data, user_id, model): 1. Feature extraction and security scoring # Extract data feature values ​​corresponding to security feature dimensions from business data flow features = model.extract_features(data) # Dynamically generate feature weight vectors weights = self.scorer.calculate_weights(features, response_time=0.076) # Obtaining the gradient of a machine learning model model_grad = model.compute_gradient(data) # Calculate the final threat score: #Basic Threat Score = Σ(Feature Weight Vector × Data Feature Values) #Final Threat Score = Base Threat Score + Vulnerability Compensation Value Based on Gradient Magnitude score = self.scorer.security_score(features, model_grad) 2. Defense Strategy Generation if score > HIGH_RISK_THRESHOLD: # Score exceeds the safety threshold # Generate adversarial test samples in a sandbox environment according to the highest attack level standard. adversarial_sample=self.validator.generate_adversarial_sample(model,data) # Generating defense strategies based on combinations of uncovered features defense_policy = self.validator.optimize_defense_policy(model.get_uncovered_combinations() # Get the exposed uncovered combinations) #Execute real-time defense strategy model.apply_defense_policy(defense_policy) 3. Blockchain audit and evidence storage # Perform homomorphic hash transformation on user identity user_hash = self.audit_chain.homomorphic_hash(user_id) # Generate and upload blockchain blocks: # Transaction body = Cryptographic identifier + Log ciphertext + Gradient magnitude self.audit_chain.create_audit_block( user_hash, # Cryptographic identifier score, # Final threat score (log element) model_grad# Gradient magnitude ) # Return security verification result return { "security_score": score, # Final threat score "response_time": 0.076, # System response time "audit_tx": user_hash# Blockchain transaction identifier } Usage Example if __name__ == "__main__": # Instantiate the security validator validator = AISecurityValidator() # Processing business data flows: #- data: Business data flow (such as cross-border payment messages) #- user_id: User identity #- model: Security detection model result = validator.process_data( data="Sensitive financial transaction data", # Business data flow user_id="user_12345",# User ID model=pretrained_ai_model# Security detection model ) # Output security verification results print(f"Security verification result: {result}") # Output Results Explanation { "security_score": 1.27, / / Final threat score "response_time": 0.076, / / System response time "audit_tx": "0x8a3d..." / / Blockchain transaction identifier }

[0079] This invention also provides a security protection device based on cross-cloud collaborative verification, such as... Figure 4 As shown, Figure 4 This invention provides a schematic diagram of a security protection device based on cross-cloud collaborative verification, applicable to cross-cloud collaborative security systems, comprising: The threat coefficient determination module 201 is used to collect security event data from multiple public clouds in real time and generate an environmental threat coefficient for each public cloud based on the security event data.

[0080] The weight vector generation module 202 is used to dynamically generate feature weight vectors for data of different security feature dimensions in the business data stream based on the environmental threat coefficient and the real-time response time of the cross-cloud collaborative security system. The business data stream is the data transmitted between multiple public clouds and includes data of various different security feature dimensions.

[0081] The threat score generation module 203 is used to calculate a basic threat score based on the feature weight vector, and to superimpose a vulnerability compensation value calculated based on the gradient magnitude of the machine learning model on the basic threat score to generate the final threat score of the business data stream. The machine learning model is a preset model for identifying security features of the business data stream.

[0082] Defense execution module 204 is used to generate adversarial test samples in a sandbox environment according to the highest attack level standard when the final threat score exceeds the security threshold score, and to generate and execute defense strategies to block attacks based on the adversarial test samples.

[0083] The threat coefficient determination module 201 includes: The quantity statistics submodule is used to aggregate security event data for each public cloud based on the cloud platform identifier to obtain the number of security events for each public cloud; The threat coefficient generation submodule is used to obtain the total amount of global security event data, and divide the number of security events in each public cloud by the total amount of global security event data to obtain the environmental threat coefficient corresponding to each public cloud.

[0084] The weight vector generation module 202 includes: The basic factor determination submodule is used to perform a weighted summation of the environmental threat coefficients of each public cloud to obtain the basic weight factor; The dynamic coefficient determination submodule is used to combine the real-time response time of the cross-cloud collaborative security system and adjust the basic weight factor through an exponential decay function to obtain the dynamic weight coefficient. The weight vector generation submodule is used to multiply dynamic weight coefficients with predefined feature importance parameters to generate feature weight vectors for data of different security feature dimensions in the business data stream.

[0085] The threat scoring generation module 203 includes: The feature extraction submodule is used to extract data feature values ​​corresponding to different security feature dimensions from the business data stream; The initial score determination submodule is used to multiply the data feature values ​​corresponding to different security feature dimensions and the corresponding feature weight vectors, and then sum them to obtain the initial score; The basic score determination submodule is used to map the initial score to a standard score range to obtain a basic threat score corresponding to the business data flow.

[0086] The threat scoring generation module 203 includes: The gradient magnitude determination submodule is used to obtain the parameter gradient matrix of the current machine learning model in real time and calculate the square root of the sum of squares of all elements in the parameter gradient matrix as the gradient magnitude. The vulnerability compensation value determination submodule is used to calculate the vulnerability compensation value based on the gradient magnitude and the compensation coefficient. The threat score determination submodule is used to add the basic threat score to the vulnerability compensation value to obtain the final threat score of the business data flow.

[0087] The defense execution module 204 includes: The test sample generation submodule is used to generate adversarial test samples based on the gradient magnitude of the machine learning model and the perturbation ratio corresponding to the highest attack level standard. The defense strategy generation submodule is used to generate defense strategies to block attacks by utilizing the combination of uncovered features exposed by adversarial test samples and combining them with the strategy diversity enhancement coefficient. The defense execution submodule is used to execute defense strategies.

[0088] This also includes: The user information conversion module is used to generate a defense strategy execution log after the defense strategy is executed, and to convert the user identity in the defense strategy execution log into an irreversible cryptographic identifier using a homomorphic hash function. The block generation module is used to encapsulate the ciphertext obtained by encrypting the cryptographic identifier, gradient magnitude, and defense strategy execution log into a transaction body, and generate a blockchain block containing zero-knowledge proofs.

[0089] The security protection device based on cross-cloud collaborative verification provided in this embodiment of the invention is included in the terminal device and can be used to execute the security protection method based on cross-cloud collaborative verification provided in the above embodiment, and has corresponding functions and beneficial effects.

[0090] It is worth noting that in the above embodiments of the security protection device based on cross-cloud collaborative verification, the various units and modules included are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of each functional unit are only for easy differentiation and are not used to limit the scope of protection of the present invention.

[0091] This embodiment also provides a terminal device, such as Figure 5 As shown, Figure 5 This is a schematic diagram of the framework of a terminal device provided in an embodiment of the present invention. The terminal device 30 includes a processor 300 and a memory 301. The memory 301 is used to store the computer program 302 and to transfer the computer program 302 to the processor 300; The processor 300 is used to execute the steps in the above embodiment of a security protection method based on cross-cloud collaborative verification according to the instructions in the computer program 302.

[0092] For example, computer program 302 may be divided into one or more modules / units, one or more of which are stored in memory 301 and executed by processor 300 to complete this application. One or more modules / units may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of computer program 302 in terminal device 30.

[0093] Terminal device 30 can be a computing device such as a desktop computer, laptop, handheld computer, or cloud server. Terminal device 30 may include, but is not limited to, processor 300 and memory 301. Those skilled in the art will understand that... Figure 5 This is merely an example of terminal device 30 and does not constitute a limitation on terminal device 30. It may include more or fewer components than shown, or combine certain components, or different components. For example, terminal device 30 may also include input / output devices, network access devices, buses, etc.

[0094] The processor 300 may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0095] The memory 301 can be an internal storage unit of the terminal device 30, such as a hard disk or RAM of the terminal device 30. The memory 301 can also be an external storage device of the terminal device 30, such as a plug-in hard disk, Smart Media Card (SMC), Secure Digital (SD) card, or FlashCard equipped on the terminal device 30. Furthermore, the memory 301 can include both internal and external storage units of the terminal device 30. The memory 301 is used to store computer programs and other programs and data required by the terminal device 30. The memory 301 can also be used to temporarily store data that has been output or will be output.

[0096] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0097] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, or indirect coupling or communication connection between apparatuses or units, and may be electrical, mechanical, or other forms.

[0098] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0099] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0100] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing computer programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0101] This invention also provides a storage medium containing computer-executable instructions, which, when executed by a computer processor, are used to perform a security protection method based on cross-cloud collaborative verification. The method includes the following steps: Real-time collection of security event data from multiple public clouds; and generation of environmental threat coefficients for each public cloud based on the security event data. Based on the environmental threat coefficient and the real-time response time of the cross-cloud collaborative security system, feature weight vectors of data with different security feature dimensions in the business data stream are dynamically generated. The business data stream is the data transmitted between multiple public clouds and includes data with various security feature dimensions. A basic threat score is calculated based on the feature weight vector. A vulnerability compensation value calculated based on the gradient magnitude of the machine learning model is then superimposed on the basic threat score to generate the final threat score of the business data stream. The machine learning model is a pre-defined model for identifying security features of the business data stream. If the final threat score exceeds the security threshold score, an adversarial test sample is generated in the sandbox environment according to the highest attack level standard. Based on the adversarial test sample, a defense strategy to block the attack is generated and executed.

[0102] Note that the above are merely preferred embodiments and the technical principles applied in this invention. Those skilled in the art will understand that the embodiments of this invention are not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions can be made without departing from the protection scope of this invention. Therefore, although the embodiments of this invention have been described in detail above, the embodiments of this invention are not limited to the above embodiments. More other equivalent embodiments may be included without departing from the concept of the embodiments of this invention, and the scope of the embodiments of this invention is determined by the scope of the appended claims.

Claims

1. A security protection method based on cross-cloud collaborative verification, applicable to cross-cloud collaborative security systems, characterized in that, The method includes: Real-time collection of security event data from multiple public clouds; and generation of an environmental threat coefficient for each public cloud based on the security event data. Based on the environmental threat coefficient and the real-time response time of the cross-cloud collaborative security system, feature weight vectors of data with different security feature dimensions in the business data stream are dynamically generated. The business data stream is the data transmitted between multiple public clouds and includes data with multiple different security feature dimensions. A basic threat score is calculated based on the feature weight vector. A vulnerability compensation value calculated based on the gradient magnitude of a machine learning model is then superimposed on the basic threat score to generate the final threat score of the business data stream. The machine learning model is a preset model for identifying security features of the business data stream. If the final threat score exceeds the security threshold score, an adversarial test sample is generated in the sandbox environment according to the highest attack level standard. Based on the adversarial test sample, a defense strategy for blocking the attack is generated and executed.

2. The security protection method for cross-cloud collaborative verification according to claim 1, characterized in that, The generation of the environmental threat coefficient for each of the public clouds based on the security event data includes: Based on the cloud platform identifier, the security event data of each public cloud is aggregated to obtain the number of security events for each public cloud; Obtain the total amount of global security incident data, and divide the number of security incidents in each of the public clouds by the total amount of global security incident data to obtain the environmental threat coefficient corresponding to each of the public clouds.

3. The security protection method for cross-cloud collaborative verification according to claim 1, characterized in that, The method of dynamically generating feature weight vectors for data of different security feature dimensions in the business data stream based on the environmental threat coefficient and the real-time response time of the cross-cloud collaborative security system includes: The environmental threat coefficients of each of the aforementioned public clouds are weighted and summed to obtain the basic weighting factor; By combining the real-time response time of the cross-cloud collaborative security system, the basic weight factor is adjusted through an exponential decay function to obtain the dynamic weight coefficient. The dynamic weight coefficients are multiplied by predefined feature importance parameters to generate feature weight vectors for data of different security feature dimensions in the business data stream.

4. The security protection method for cross-cloud collaborative verification according to claim 1, characterized in that, The calculation of the basic threat score based on the feature weight vector includes: Extract data feature values ​​corresponding to different security feature dimensions from the business data stream; The initial score is obtained by multiplying the data feature values ​​corresponding to different security feature dimensions and their corresponding feature weight vectors, and then summing the results. The initial score is mapped to a standard score range to obtain a basic threat score corresponding to the business data stream.

5. The security protection method for cross-cloud collaborative verification according to claim 1, characterized in that, The step of superimposing a vulnerability compensation value calculated based on the gradient magnitude of a machine learning model onto the basic threat score to generate the final threat score of the business data stream includes: The parameter gradient matrix of the current machine learning model is obtained in real time, and the square root of the sum of squares of all elements in the parameter gradient matrix is ​​used as the gradient magnitude. Based on the gradient magnitude and compensation coefficient, the vulnerability compensation value is calculated; The base threat score is added to the vulnerability compensation value to obtain the final threat score of the business data stream.

6. The security protection method for cross-cloud collaborative verification according to claim 1, characterized in that, The process of generating adversarial test samples in a sandbox environment according to the highest attack level standard, and generating and executing defense strategies to block attacks based on the adversarial test samples, includes: Based on the gradient magnitude of the machine learning model, adversarial test samples are generated according to the perturbation ratio corresponding to the highest attack level standard. By utilizing the uncovered feature combinations exposed by the adversarial test samples, and combining them with the strategy diversity enhancement coefficient, a defense strategy for blocking attacks is generated. Implement the defense strategy described above.

7. The security protection method for cross-cloud collaborative verification according to claim 3, characterized in that, After implementing the aforementioned defense strategy, the following is also included: Generate a defense strategy execution log, and convert the user identity in the defense strategy execution log into an irreversible cryptographic identifier using a homomorphic hash function; The cryptographic identifier, the gradient magnitude, and the execution log of the defense strategy are encrypted to obtain a ciphertext, which is then encapsulated into a transaction body to generate a blockchain block containing zero-knowledge proofs.

8. A security protection device based on cross-cloud collaborative verification, applicable to cross-cloud collaborative security systems, characterized in that, The device includes: The threat coefficient determination module is used to collect security event data from multiple public clouds in real time and generate an environmental threat coefficient for each public cloud based on the security event data. The weight vector generation module is used to dynamically generate feature weight vectors for data of different security feature dimensions in the business data stream based on the environmental threat coefficient and the real-time response time of the cross-cloud collaborative security system. The business data stream is data transmitted between multiple public clouds and includes data of various security feature dimensions. The threat score generation module is used to calculate a basic threat score based on the feature weight vector, and to superimpose a vulnerability compensation value calculated based on the gradient magnitude of a machine learning model on the basic threat score to generate the final threat score of the business data stream. The machine learning model is a preset model for identifying security features of the business data stream. The defense execution module is used to generate adversarial test samples in a sandbox environment according to the highest attack level standard when the final threat score exceeds the security threshold score, and to generate and execute defense strategies to block attacks based on the adversarial test samples.

9. A terminal device, characterized in that, The terminal device includes a processor and a memory; The memory is used to store computer programs and to transfer the computer programs to the processor; The processor is used to execute a security protection method based on cross-cloud collaborative verification as described in any one of claims 1-7 according to the instructions in the computer program.

10. A storage medium for storing computer-executable instructions, characterized in that, The computer-executable instructions, when executed by a computer processor, are used to perform a security protection method based on cross-cloud collaborative verification as described in any one of claims 1-7.

Images