Distributed network security early warning method based on cloud computing

Abstract

The invention discloses a distributed network security early warning method based on cloud computing, and the method comprises the steps: collecting distributed data, and outputting a standardized tensor format; extracting local features, and outputting dynamic feature vectors; executing asynchronous federated learning at the cloud, integrating the characteristics of each node, and dynamically adjusting the weight of the characteristics; automatically reducing the feature weight of the edge node which is not updated for a long time; constructing a dynamic threat map; outputting a threat propagation thermodynamic diagram, and marking a high-risk area; performing multi-stage threat detection; generating a response strategy according to the threat type; executing a cross-domain strategy; and performing feedback updating on an execution result so as to perform continuous optimization. According to the method, original data are ensured to meet compliance requirements through federal feature engineering and a local differential privacy technology; the edge-cloud cooperative detection mechanism improves the first threat packet blocking rate and reduces the response delay; the dynamic graph deduces an attack path in real time and prejudges a threat diffusion direction; and the operation and maintenance cost is reduced due to the reinforcement learning-driven response strategy library.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically to a distributed network security early warning method based on cloud computing. Background Technology

[0002] Current mainstream cybersecurity early warning solutions mainly rely on two types of technologies: centralized cloud analysis (such as the Splunk architecture): aggregating network data to a central cloud platform and using machine learning models (such as LSTM) for threat detection. Static rule engines: matching network traffic based on predefined signature codes and generating alerts by combining them with vulnerability databases (CVEs).

[0003] Existing technologies pose privacy risks, and centralized processing requires uploading raw data, violating compliance requirements such as GDPR (especially prominent in medical / financial scenarios); high response latency: cloud-based analysis leads to delays in threat handling and makes it impossible to block first-packet attacks. Summary of the Invention

[0004] Therefore, this invention provides a distributed network security early warning method based on cloud computing to solve the problems in the prior art.

[0005] To achieve the above objectives, the present invention provides the following technical solution:

[0006] A cloud-based distributed network security early warning method includes the following steps:

[0007] Step 1: Distributed data acquisition, deploying lightweight probes at edge nodes to collect data synchronously; performing local differential privacy perturbations on sensitive fields; and outputting a standardized tensor format;

[0008] Step 2: Local feature extraction, running a lightweight hybrid model on edge nodes, and outputting dynamic feature vectors;

[0009] Step 3: Federated Feature Aggregation; Asynchronous federated learning is performed in the cloud to integrate features from each node and dynamically adjust feature weights; the feature weights of edge nodes that have not been updated for a long time are automatically reduced.

[0010] Step 4: Construct a dynamic threat map; integrate historical vulnerability databases and real-time attack chains; use graph neural networks (GNNs) to infer attack paths and predict the direction of potential threat spread; output a threat propagation heatmap and mark high-risk areas;

[0011] Step 5: Multi-level threat detection. Deploy lightweight detection engines at the edge gateway and in the cloud to screen and analyze threats.

[0012] Step 6: Adaptive response decision-making, generating response strategies based on threat type;

[0013] Step 7: Cross-domain policy execution. Send instructions to the cloud and edge devices via standard APIs and execute the sent policies.

[0014] Step 8: Feedback and updates on the execution results for continuous optimization, including optimizing the policy library every n days using historical data through reinforcement learning.

[0015] Furthermore, the distributed data collected in step 1 includes: network traffic metadata, system logs, and DPU hardware status.

[0016] Furthermore, the specific steps of federated feature aggregation in step 3 are as follows:

[0017] (1) At the edge nodes, the local statistics are calculated as follows:

[0018] (2) Then, in the cloud aggregation stage; calculate the confidence level of all nodes. Then dynamically allocate aggregate weights. Perform feature attention pooling to obtain a refined feature set; and update the global model.

[0019] (3) When a feature is not selected into the final feature set for L consecutive rounds, exponential decay is forcibly triggered.

[0020] Furthermore: the formula for calculating the confidence level is as follows:

[0021] ;

[0022] in, α represents the overall confidence level of node i at time t; α represents the performance factor weight coefficient; β represents the timeliness factor weight coefficient; and γ represents the diversity reward weight coefficient. Δt represents the prediction accuracy of the local model at node i. i H(N) represents the time interval between node i and the last communication; λ is the time-sensitivity decay coefficient; H(N) i Let α be the information entropy of the data distribution at node i; where α + β + γ = 1.

[0023] Furthermore: the aggregate weight The calculation formula is:

[0024] ;

[0025] in, Let be the aggregate weight of node i at time t; N is the total number of nodes participating in federated learning. This is the sum of the confidence scores of all nodes j; Let be the overall confidence level of node i at time t; Let be the overall confidence level of node j at time t.

[0026] Furthermore: During the feature attention pooling, the formula for calculating the feature-level attention mask is as follows:

[0027] ;

[0028] in, Let be the attention mask for the k-th dimension feature at time t; σ(·) is the SiLU activation function (smooth gating); Let be the contribution vector of node i to the k-th feature; ⊙ represents the Hadamard element-wise multiplication.

[0029] Furthermore: the formula for the exponentially decaying characteristic importance decay is:

[0030] ;

[0031] in, The importance score of feature k at time t is given; η is the decay base; δ(k,t) is the number of times feature k is not selected consecutively.

[0032] Furthermore, in step 5, a random forest classifier is deployed on the edge gateway to achieve rapid initial screening of attacks; and suspicious traffic is deeply analyzed in the cloud to detect unknown threats.

[0033] Furthermore, the response strategy includes: in the event of credential leakage or theft, real-time triggering of account isolation and two-factor authentication activation; in the event of a DDoS attack, automatically sending cleaning rules to the SASE gateway; and in the event of ransomware, blocking port 455 and locking the backup system.

[0034] Furthermore: In step 8, the specific content of updating the execution result feedback is as follows:

[0035] For federated model updates: retrain the SSO weights every n hours using the new feature vectors;

[0036] Threat Graph Evolution: Automatically create graph nodes when OGTN detects new types of attacks;

[0037] Policy library evolution: Reinforcement learning agents adjust the probability of action selection based on response effects.

[0038] This invention has the following advantages: by using federated feature engineering and local differential privacy technology, it ensures that the original data does not leave the local domain, meets compliance requirements, and eliminates the risk of privacy leakage from the root; the edge-cloud collaborative detection mechanism improves the first packet blocking rate of threats and reduces response latency; the dynamic graph infers attack paths in real time and predicts the direction of threat spread; and the reinforcement learning-driven response strategy library reduces operation and maintenance costs.

[0039] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. Attached Figure Description

[0040] To more intuitively illustrate the prior art and this application, exemplary drawings are provided below. It should be understood that the specific shapes and structures shown in the drawings should not generally be regarded as limiting conditions for implementing this application; for example, based on the technical concept disclosed in this application and the exemplary drawings, those skilled in the art are able to easily make conventional adjustments or further optimizations to the addition / reduction / classification, specific shapes, positional relationships, connection methods, size ratios, etc. of certain units (components).

[0041] Figure 1 This is a flowchart of a distributed network security early warning method based on cloud computing, as described in this application. Detailed Implementation

[0042] The following specific embodiments illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. It should be understood that these embodiments are merely for further explanation of the present invention and should not be construed as limiting the scope of protection of the present invention. Technical engineers in the field can make some non-essential improvements and adjustments to the present invention based on the above-described content. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0043] Please see Figure 1 A cloud-based distributed network security early warning method includes the following steps:

[0044] Step 1: Distributed data collection. Deploy lightweight probes at edge nodes (enterprise gateways / cloud servers) to synchronously collect: network traffic metadata (five-tuples + packet length time series), system logs (Syslog structured key events), and DPU hardware status (utilization, cache hit rate).

[0045] Local Differential Privacy (LDP) perturbation is applied to sensitive fields (IP, MAC); and a normalized tensor format is output, which is: [timestamp, event type, resource utilization].

[0046] Step 2: Local feature extraction, running a lightweight hybrid model on edge nodes, and outputting dynamic feature vectors.

[0047] Step 3: Federated Feature Aggregation; By performing asynchronous federated learning in the cloud scheduling center, the features of each node are integrated, and the feature weights are dynamically adjusted using the Stadium Audience Optimization (SSO) algorithm to reduce communication overhead.

[0048] A feature importance decay mechanism is introduced to automatically reduce the feature weights of edge nodes that have not been updated for a long time, preventing data drift from affecting model accuracy.

[0049] Specifically, (1) First, in the local computation stage (edge ​​node), the local statistics are calculated as follows:

[0050] ;in, D represents the local model parameters for the i-th edge node. i Let be the set of local data samples stored at the i-th edge node; ▽L is the gradient operator of the loss function L, representing the gradient of all input variables (here ) to the loss function L. The vector after differentiation;

[0051] The reported compressed metadata is: {accuracy, timestamp, feature_stats}.

[0052] (2) Then, in the cloud aggregation stage;

[0053] Calculate the confidence score of all nodes. The formula for calculating the confidence level is:

[0054] ;

[0055] in, α represents the overall confidence level of node i at time t; α represents the performance factor weight coefficient; β represents the timeliness factor weight coefficient; and γ represents the diversity reward weight coefficient. The prediction accuracy of the local model for node i; H(N) represents the time interval between node i and the last communication; λ is the time-sensitivity decay coefficient; H(N) i Let α be the information entropy of the data distribution at node i; where α + β + γ = 1.

[0056] Then dynamically allocate aggregation weights. ; The calculation formula is:

[0057] ;

[0058] Where N is the total number of nodes participating in federated learning; This is the sum of the confidence scores of all nodes j.

[0059] For example: There are 3 nodes in the system (N=3):

[0060] Confidence level of node 1: ;

[0061] Confidence level of node 2: ;

[0062] Confidence level of node 3: ;

[0063] The denominator is: ;

[0064] If we calculate the weight of node 1: .

[0065] (3) Subsequently, feature attention pooling is performed to obtain a refined feature set; and the global model is updated.

[0066] The formula for calculating the feature-level attention mask is as follows:

[0067] ;

[0068] in, Let be the attention mask for the k-th dimension feature at time t; The SiLU activation function (smooth gate); Let be the contribution vector of node i to the k-th feature; ⊙ represents the Hadamard element-wise multiplication. A gated network is used to automatically identify key feature dimensions, enabling selective aggregation at the feature granularity level.

[0069] (4) When a feature is not selected into the final feature set for L consecutive rounds, exponential decay is forcibly triggered;

[0070] The formula for feature importance decay is:

[0071] ;

[0072] in, The importance score of feature k at time t is given; η is the decay base, typically 0.95-0.99; δ(k,t) is the number of times feature k is not selected consecutively.

[0073] Step 4: Construct a dynamic threat map;

[0074] It integrates historical vulnerability databases and real-time attack chains; uses graph neural networks (GNNs) to infer attack paths and predict the direction of potential threat spread, such as the lateral movement of ransomware; outputs a threat propagation heatmap and marks high-risk areas.

[0075] Construct a risk quantification model, calculate threat risk values ​​based on Bayesian decision trees, and output a multidimensional risk assessment matrix (including confidence level, scope of impact, etc.).

[0076] Step 5: Multi-level threat detection. Deploy lightweight detection engines at the edge gateway and in the cloud for threat screening and analysis.

[0077] Deploy a Random Forest Classifier (RFA) on the edge gateway to achieve rapid initial attack screening; perform in-depth analysis of suspicious traffic in the cloud and optimize the Gated Transformer (OGTN) model to detect unknown threats.

[0078] In addition, the detection granularity can be dynamically adjusted according to the computing power of edge devices. For example, when the computing power is low, it can only run on the edge gateway for initial screening.

[0079] Step 6: Adaptive response decision-making, generating response strategies based on threat type; for example: in case of credential leakage or theft, real-time triggering of account isolation and two-factor authentication activation; in case of DDoS attack, automatically issuing cleaning rules to the SASE gateway; in case of ransomware, blocking port 455 and locking the backup system.

[0080] We optimize the policy library weekly using historical data through reinforcement learning to reduce false positives.

[0081] Step 7: Cross-domain policy execution. Send instructions to the cloud and edge devices (including edge gateways) via standard APIs and execute the sent policies.

[0082] In addition, it can work with cloud platform firewalls (such as Windows Defender Smart Engine) to dynamically generate geofencing and protocol filtering rules; edge devices can push lightweight policy packages via the MQTT protocol.

[0083] Step 8: Provide feedback and updates to achieve continuous optimization;

[0084] Specifically, for federated model updates: the SSO weights are retrained every 24 hours using new feature vectors;

[0085] Threat Graph Evolution: Automatically create graph nodes when OGTN detects new types of attacks;

[0086] Policy library evolution: Reinforcement learning agents adjust the probability of action selection based on response effects.

[0087] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A distributed network security early warning method based on cloud computing, characterized in that, Includes the following steps: Step 1: Distributed data acquisition, deploying lightweight probes on edge nodes to collect data synchronously; Apply local differential privacy perturbations to sensitive fields and output a normalized tensor format. Step 2: Local feature extraction, running a lightweight hybrid model on edge nodes, and outputting dynamic feature vectors; Step 3: Federated Feature Aggregation; Asynchronous federated learning is performed in the cloud to integrate the features of each node and dynamically adjust the feature weights; the feature weights of edge nodes that have not been updated for a long time are automatically reduced. Step 4: Construct a dynamic threat map; integrate historical vulnerability databases and real-time attack chains; use graph neural networks (GNNs) to infer attack paths and predict the direction of potential threat spread; output a threat propagation heatmap and mark high-risk areas; Step 5: Multi-level threat detection. Deploy lightweight detection engines at the edge gateway and in the cloud to screen and analyze threats. Step 6: Adaptive response decision-making, generating response strategies based on threat type; Step 7: Cross-domain policy execution. Send instructions to the cloud and edge devices via standard APIs and execute the sent policies. Step 8: Feedback and updates on the execution results for continuous optimization, including optimizing the policy library every n days using historical data through reinforcement learning.

2. The distributed network security early warning method based on cloud computing according to claim 1, characterized in that, The distributed data collected in step 1 includes: network traffic metadata, system logs, and DPU hardware status.

3. The distributed network security early warning method based on cloud computing according to claim 1, characterized in that, The specific steps of federated feature aggregation in step 3 are as follows: (1) At the edge nodes, the local statistics are calculated as follows: (2) Then, in the cloud aggregation stage; calculate the confidence level of all nodes. Then dynamically allocate aggregate weights. Perform feature attention pooling to obtain a refined feature set; and update the global model. (3) When a feature is not selected into the final feature set for L consecutive rounds, exponential decay is forcibly triggered.

4. The distributed network security early warning method based on cloud computing according to claim 3, characterized in that, The formula for calculating the confidence level is: ； in, α represents the overall confidence level of node i at time t; α represents the performance factor weight coefficient; β represents the timeliness factor weight coefficient; and γ represents the diversity reward weight coefficient. Δt represents the prediction accuracy of the local model at node i. i H(N) represents the time interval between node i and the last communication; λ is the time-sensitivity decay coefficient; H(N) i Let α be the information entropy of the data distribution at node i; where α + β + γ = 1.

5. The distributed network security early warning method based on cloud computing according to claim 3, characterized in that, The aggregate weight The calculation formula is: ； in, Let be the aggregate weight of node i at time t; N is the total number of nodes participating in federated learning. This is the sum of the confidence scores of all nodes j; Let be the overall confidence level of node i at time t; Let be the overall confidence level of node j at time t.

6. The distributed network security early warning method based on cloud computing according to claim 3, characterized in that, The formula for calculating the feature-level attention mask during feature attention pooling is as follows: ； in, Let be the attention mask for the k-th dimension feature at time t; σ(·) is the SiLU activation function; Let be the contribution vector of node i to the k-th feature; ⊙ represents the Hadamard element-wise multiplication.

7. The distributed network security early warning method based on cloud computing according to claim 3, characterized in that, The characteristic importance decay formula for exponential decay is: ； in, The importance score of feature k at time t is given; η is the decay base; δ(k,t) is the number of times feature k is not selected consecutively.

8. The distributed network security early warning method based on cloud computing according to claim 1, characterized in that, In step 5, a random forest classifier is deployed on the edge gateway to achieve rapid initial screening of attacks; and suspicious traffic is analyzed in depth in the cloud to detect unknown threats.

9. A distributed network security early warning method based on cloud computing according to claim 1, characterized in that, The response strategies include: in the event of credential leakage or theft, real-time triggering of account isolation and two-factor authentication activation; in the event of a DDoS attack, automatic distribution of cleaning rules to the SASE gateway; and in the event of ransomware, blocking port 455 and locking the backup system.

10. A distributed network security early warning method based on cloud computing according to claim 1, characterized in that, In step 8, the specific content of updating the execution result feedback is as follows: For federated model updates: retrain the SSO weights every n hours using the new feature vectors; Threat Graph Evolution: Automatically create graph nodes when OGTN detects new types of attacks; Policy library evolution: Reinforcement learning agents adjust the probability of action selection based on response effects.

Images