A cloud-computing-based distributed network security early warning method

Abstract

The application discloses a kind of distributed network security early warning method based on cloud computing, comprising: distributed data acquisition, and output standardization tensor format;Local feature extraction, and output dynamic feature vector;Asynchronous federal learning is executed in cloud, integrates each node feature, and dynamically adjusts feature weight;The feature weight of long-term unupdated edge node is automatically reduced;Dynamic threat atlas is constructed;Output threat propagation heat map, and mark out high-risk area;Multi-level threat detection;Response strategy is generated according to threat type;Cross-domain strategy execution;The execution result is updated to continuously optimize, with the original data meeting compliance requirements by federal feature engineering and local differential privacy technology;Edge-cloud collaborative detection mechanism improves threat first packet blocking rate, and reduces response delay;Dynamic atlas real-time deduces attack path, and predicts threat diffusion direction;Response strategy library driven by reinforcement learning reduces operation and maintenance cost.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a distributed network security early warning method based on cloud computing. BACKGROUND

[0002] The current mainstream network security early warning scheme mainly relies on two types of technologies: centralized cloud analysis (such as Splunk architecture): all network data is aggregated to a central cloud platform, and a machine learning model (such as LSTM) is used for threat detection. Static rule engine: based on pre-defined feature code matching network traffic, combined with vulnerability library (CVE) to generate alarms.

[0003] The existing technology has the risk of privacy leakage, and the centralized processing requires uploading original data, which violates the compliance requirements such as GDPR (especially in medical / financial scenarios); high response delay: cloud analysis causes threat disposal to lag behind, and cannot block the first packet attack. SUMMARY

[0004] Therefore, the present application provides a distributed network security early warning method based on cloud computing to solve the problems in the prior art.

[0005] In order to achieve the above purpose, the present application provides the following technical scheme:

[0006] A distributed network security early warning method based on cloud computing, comprising the following steps:

[0007] Step 1: distributed data collection, deploying a lightweight probe on the edge node, synchronously collecting data; performing local differential privacy disturbance on sensitive fields; and outputting a standardized tensor format;

[0008] Step 2: local feature extraction, the edge node running a lightweight hybrid model and outputting a dynamic feature vector;

[0009] Step 3: federated feature aggregation; performing asynchronous federated learning in the cloud, integrating features of each node, dynamically adjusting feature weights; and automatically reducing the feature weight of an edge node that has not been updated for a long time;

[0010] Step 4: constructing a dynamic threat map; integrating a historical vulnerability library and real-time attack chain; using a graph neural network GNN to infer an attack path and predict a potential threat diffusion direction; outputting a threat propagation heat map and marking a high-risk area;

[0011] Step 5: multi-level threat detection, deploying lightweight detection engines on the edge gateway and the cloud respectively to screen and analyze threats;

[0012] Step 6: adaptive response decision, generating a response strategy according to the threat type;

[0013] Step 7: Cross-domain policy execution, issuing instructions to the cloud and edge devices through standard APIs, and executing the issued policies.

[0014] Step 8: Feedback update of execution results for continuous optimization, including optimization of the policy library through reinforcement learning using historical data every n days.

[0015] Further: the distributed data collected in step 1 includes network traffic metadata, system logs, and DPU hardware status.

[0016] Further: the specific steps of federated feature aggregation in step 3 are as follows:

[0017] (1) At the edge node, calculate the local statistics as:

[0018] (2) Then, in the cloud aggregation stage; calculate the confidence of all nodes , then dynamically allocate aggregation weights ; perform feature attention pooling to obtain a refined feature set; and update the global model;

[0019] (3) When a feature is not selected into the final feature set for L consecutive rounds, trigger exponential decay.

[0020] Further: the calculation formula of the confidence is:

[0021] ;

[0022] Where, is the comprehensive confidence of node i at time t; α is the performance factor weight coefficient; β is the timeliness factor weight coefficient; γ is the diversity reward weight coefficient; is the prediction accuracy of node i local model; Δt i is the time interval of node i from the last communication; λ is the timeliness decay coefficient; H(N i ) is the information entropy of node i data distribution; where α+β+γ=1.

[0023] Further: the calculation formula of the aggregation weight is:

[0024] ;

[0025] Where, is the aggregation weight of node i at time t; N is the total number of nodes participating in federated learning; is the sum of the confidence of all nodes j; is the comprehensive confidence of node i at time t; is the comprehensive confidence of node j at time t.

[0026] Further, when the feature attention is pooled, the calculation formula of the feature-level attention mask is:

[0027] ;

[0028] Wherein, is the attention mask of the k-dimensional feature at time t; and sigma (·) is a SiLU activation function (smooth gate). is the contribution vector of node i to the kth feature; and is a Hadamard element-wise multiplication.

[0029] Further, the feature importance decay formula of the exponential decay is:

[0030] ;

[0031] Wherein, is the importance score of feature k at time t; η is the decay base; and δ(k, t) is the number of times that feature k is continuously not selected.

[0032] Further, in step 5, a random forest classifier is deployed on the edge gateway to realize rapid attack preliminary screening; and suspicious traffic is deeply analyzed in the cloud to realize detection of unknown threats.

[0033] Further, the response strategy includes: when the credentials are leaked or stolen, the account isolation and two-factor authentication activation are triggered in real time; when the DDoS attack occurs, the cleaning rules are automatically issued to the SASE gateway; and when the ransomware occurs, the 455 port is blocked, and the backup system is locked.

[0034] Further, in step 8, the specific content of the feedback update of the execution result is:

[0035] For federated model updating: the SSO weight is retrained with a new feature vector every n hours;

[0036] Threat graph evolution: when a new attack is detected by OGTN, a graph node is automatically created;

[0037] Strategy library evolution: the reinforcement learning agent adjusts the action selection probability according to the response effect.

[0038] The application has the following advantages: through federated feature engineering and local differential privacy technology, it is ensured that the original data does not go out of the local region, the compliance requirements are met, and the privacy leakage risk is eliminated from the root; the edge-cloud collaborative detection mechanism improves the threat first packet blocking rate and reduces the response delay; the dynamic graph deduces the attack path in real time, and predicts the threat diffusion direction; the response strategy library driven by reinforcement learning reduces the operation and maintenance cost.

[0039] Other features and advantages of the present application will be set forth in the following description, and in part will be apparent from the description, or can be learned by practice of the application. BRIEF DESCRIPTION OF DRAWINGS

[0040] In order to more intuitively illustrate the prior art and the present application, exemplary drawings are given below. It should be understood that the specific shapes, structures shown in the drawings should not be considered as limiting conditions in the implementation of the present application; for example, based on the technical concepts disclosed in the present application and the exemplary drawings, those skilled in the art can easily make routine adjustments or further optimizations to some units (components) in terms of increase / decrease / assignment, specific shape, positional relationship, connection mode, size ratio relationship, etc.

[0041] Figure 1 A flowchart of a cloud computing-based distributed network security early warning method of the present application. DETAILED DESCRIPTION

[0042] The embodiments of the present application are described below by specific specific embodiments, and those skilled in the art can easily understand other advantages and effects of the present application from the disclosed content. Obviously, the described embodiments are part of the embodiments of the present application, not all. It should be understood that these embodiments are only for further illustration of the present application, and cannot be understood as a limitation on the scope of protection of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0043] Please refer to Figure 1 A cloud computing-based distributed network security early warning method, comprising the following steps:

[0044] Step 1: Distributed data acquisition, deploying lightweight probes on edge nodes (enterprise gateway / cloud server) to synchronously collect network traffic metadata (five-tuple+ packet length time series), system logs (Syslog structured key events) and DPU hardware status (utilization, cache hit rate);

[0045] Sensitive fields (IP, MAC) are subjected to local differential privacy (LDP) perturbation; and a standardized tensor format is output, the standardized tensor format being: [timestamp, event type, resource occupancy rate].

[0046] Step 2: Local feature extraction, the edge node running a lightweight hybrid model and outputting a dynamic feature vector.

[0047] Step 3: Federated Feature Aggregation; By executing asynchronous federated learning in the cloud scheduling center, integrating features from each node, dynamically adjusting feature weights using the Sports Stadium Observer Optimization algorithm (SSO), and reducing communication overhead.

[0048] Introduce feature importance decay mechanism, automatically reduce the feature weight of long-term non-updated edge node, prevent data drift from affecting model accuracy.

[0049] Specifically, (1) First, in the local calculation stage (edge node), calculate the local statistics as:

[0050] ; Where, is the local model parameter of the i-th edge node; D i is the local data sample set stored by the i-th edge node; ∇L is the gradient operator of the loss function L, representing the vector after taking the derivative of all input variables (here, the ) of the loss function L;

[0051] Report the compressed meta-information as: {accuracy, timestamp, feature_stats}.

[0052] (2) Then, in the cloud aggregation stage;

[0053] Calculate the confidence of all nodes , the calculation formula of the confidence is:

[0054] ;

[0055] Where, is the comprehensive confidence of node i at time t; α is the performance factor weight coefficient; β is the timeliness factor weight coefficient; γ is the diversity reward weight coefficient; is the prediction accuracy of node i local model; is the time interval of node i from the last communication; λ is the timeliness decay coefficient; H(N i ) is the information entropy of the data distribution of node i; Where, α+β+γ=1.

[0056] Then dynamically allocate the aggregation weight ; The calculation formula of is;

[0057] ;

[0058] Where, N is the total number of nodes participating in federated learning; is the sum of the confidence of all nodes j.

[0059] For example: There are 3 nodes (N=3) in the system:

[0060] Confidence of node 1: ;

[0061] Confidence of node 2: ;

[0062] Confidence of node 3: ;

[0063] Then the denominator is: ;

[0064] If the weight of node 1 is calculated: .

[0065] (3) Then, perform feature attention pooling to obtain a refined feature set; and update the global model.

[0066] The calculation formula of the feature-level attention mask is:

[0067] ;

[0068] wherein, is the attention mask of the k-th feature at time t; is the SiLU activation function (smooth gate); is the contribution vector of node i to the k-th feature; and is the Hadamard element-wise multiplication. The key feature dimension is automatically identified by the gating network, and selective aggregation at the feature granularity is achieved.

[0069] (4) When a certain feature is not selected into the final feature set for L consecutive rounds, an exponential decay is forcibly triggered;

[0070] The feature importance decay formula is:

[0071] ;

[0072] wherein, is the importance score of feature k at time t; η is the decay base, typically taken as 0.95-0.99; δ(k,t) is the number of consecutive times that feature k is not selected.

[0073] Step 4: Construct a dynamic threat map;

[0074] Integrate the historical vulnerability library and real-time attack chain; use the graph neural network GNN to infer the attack path and predict the potential threat diffusion direction, such as lateral movement of ransomware; output the threat propagation heat map and label the high-risk areas.

[0075] Build a risk quantification model, calculate the threat risk value based on the Bayesian decision tree, and output a multi-dimensional risk assessment matrix (including confidence, impact range, etc.).

[0076] Step 5: Multi-level threat detection, lightweight detection engines are deployed on edge gateways and in the cloud respectively for threat screening and analysis.

[0077] Random Forest Classifier (RFA) is deployed on edge gateways for rapid attack preliminary screening; through cloud deep analysis, an unknown threat detection is realized through an Optimized Gated Transformer (OGTN) model.

[0078] In addition, the detection granularity can be dynamically adjusted according to the computing power of the edge device, for example, only preliminary screening is performed on the edge gateway when the computing power is low.

[0079] Step 6: Adaptive response decision, generate response strategies according to threat types; for example: when credentials are leaked or stolen, real-time account isolation and two-factor authentication activation are triggered; for DDoS attacks, cleaning rules are automatically issued to SASE gateways; for ransomware, port 455 is blocked and backup systems are locked.

[0080] Optimize the strategy library through reinforcement learning with historical data every week to reduce false positive rate.

[0081] Step 7: Cross-domain policy execution, issue instructions to the cloud and edge devices (including edge gateways) through standard APIs, and execute the issued policies;

[0082] In addition, it can also be coordinated with cloud platform firewalls (such as Windows Defender intelligent engine) to dynamically generate geofencing and protocol filtering rules; edge devices can push lightweight policy packages through MQTT protocol.

[0083] Step 8: Feedback update to achieve continuous optimization;

[0084] Among them, for federal model update: retrain SSO weights with new feature vectors every 24 hours;

[0085] Threat graph evolution: automatically create graph nodes when OGTN detects new attacks;

[0086] Strategy library evolution: reinforcement learning agent adjusts action selection probability according to response effect.

[0087] The above only describes the preferred embodiments of the present application and does not limit the present application. Any modification, equivalent replacement and improvement within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A distributed network security early warning method based on cloud computing, characterized in that, Includes the following steps: Step 1: Distributed data acquisition, deploying lightweight probes on edge nodes to collect data synchronously; Apply local differential privacy perturbations to sensitive fields and output a normalized tensor format. Step 2: Local feature extraction, running a lightweight hybrid model on edge nodes, and outputting dynamic feature vectors; Step 3: Federated Feature Aggregation; Asynchronous federated learning is performed in the cloud to integrate the features of each node and dynamically adjust the feature weights; the feature weights of edge nodes that have not been updated for a long time are automatically reduced. Step 4: Construct a dynamic threat map; integrate historical vulnerability databases and real-time attack chains; use graph neural networks (GNNs) to infer attack paths and predict the direction of potential threat spread; output a threat propagation heatmap and mark high-risk areas; Step 5: Multi-level threat detection. Deploy lightweight detection engines at the edge gateway and in the cloud to screen and analyze threats. Step 6: Adaptive response decision-making, generating response strategies based on threat type; Step 7: Cross-domain policy execution. Send instructions to the cloud and edge devices via standard APIs and execute the sent policies. Step 8: Feedback and update the execution results for continuous optimization, including optimizing the policy library every n days using historical data through reinforcement learning; The specific steps of federated feature aggregation in step 3 are as follows: (1) At the edge nodes, the local statistics are calculated as follows: (2) Then, in the cloud aggregation stage; calculate the confidence level of all nodes. Then dynamically allocate aggregate weights. Perform feature attention pooling to obtain a refined feature set; and update the global model. (3) When a feature is not selected into the final feature set for L consecutive rounds, exponential decay is forcibly triggered; The confidence level is calculated using the following formula: ； in, α represents the overall confidence level of node i at time t; α represents the performance factor weight coefficient; β represents the timeliness factor weight coefficient; and γ represents the diversity reward weight coefficient. Δt represents the prediction accuracy of the local model at node i. i H(N) represents the time interval between node i and the last communication; λ is the time-sensitivity decay coefficient; H(N) i Let α be the information entropy of the data distribution at node i; where α + β + γ = 1.

2. The distributed network security early warning method based on cloud computing according to claim 1, characterized in that, The distributed data collected in step 1 includes: network traffic metadata, system logs, and DPU hardware status.

3. The distributed network security early warning method based on cloud computing according to claim 1, characterized in that, The aggregate weight The calculation formula is: ； in, Let be the aggregate weight of node i at time t; N is the total number of nodes participating in federated learning. This is the sum of the confidence scores of all nodes j; Let be the overall confidence level of node i at time t; Let be the overall confidence level of node j at time t.

4. The distributed network security early warning method based on cloud computing according to claim 1, characterized in that, The formula for calculating the feature-level attention mask during feature attention pooling is as follows: ； in, Let be the attention mask for the k-th dimension feature at time t; σ(·) is the SiLU activation function; Let be the contribution vector of node i to the k-th feature; ⊙ represents the Hadamard element-wise multiplication.

5. The distributed network security early warning method based on cloud computing according to claim 1, characterized in that, The characteristic importance decay formula for exponential decay is: ； in, The importance score of feature k at time t is given; η is the decay base; δ(k,t) is the number of times feature k is not selected consecutively.

6. The distributed network security early warning method based on cloud computing according to claim 1, characterized in that, In step 5, a random forest classifier is deployed on the edge gateway to achieve rapid initial screening of attacks; and suspicious traffic is analyzed in depth in the cloud to detect unknown threats.

7. The distributed network security early warning method based on cloud computing according to claim 1, characterized in that, The response strategies include: in the event of credential leakage or theft, real-time triggering of account isolation and two-factor authentication activation; in the event of a DDoS attack, automatic distribution of cleaning rules to the SASE gateway; and in the event of ransomware, blocking port 455 and locking the backup system.

8. The distributed network security early warning method based on cloud computing according to claim 1, characterized in that, In step 8, the specific content of updating the execution result feedback is as follows: For federated model updates: retrain the SSO weights every n hours using the new feature vectors; Threat Graph Evolution: Automatically create graph nodes when OGTN detects new types of attacks; Policy library evolution: Reinforcement learning agents adjust the probability of action selection based on response effects.

Images