Server security risk identification method and system

Abstract

The invention relates to the technical field of big data analysis, in particular to a server security risk identification method and system, the server security risk identification system comprises a multi-source data acquisition module, a feature fusion module, a dynamic risk analysis module and a risk disposal module; collecting multi-source data by adopting a mixed collection mode, and associating the multi-source data based on a preset association identifier; performing standardized conversion and mapping on the associated multi-source data, and generating composite features according to extracted features; preprocessing the composite features, inputting the preprocessed composite features into a machine learning model to carry out weighted calculation on the features, and generating a risk level based on a dynamic threshold value; and the risk descriptor generated based on the risk level is combined with the context state and then is matched with the set processing rule base to generate a corresponding risk processing scheme, so that the recognition accuracy and timeliness are improved.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of big data analysis, and in particular to a server security risk identification method and system. BACKGROUND

[0002] With the rapid development of Internet technology, servers as core infrastructure are facing increasingly complex security threats. The server is an important support for the operation of enterprise business, and its security is directly related to the information security of the enterprise. Therefore, the evaluation and management of server security problems are crucial. Server security risk identification is one of the important measures to evaluate the security risks of servers, prevent security vulnerabilities from being exploited by hackers, and protect enterprise information security.

[0003] Traditional server security risk identification methods are mostly based on single data sources (such as system logs or network traffic) for analysis, using static rules or fixed threshold matching mechanisms. For example, by predefining a malicious IP blacklist or an abnormal login number threshold to trigger an alarm. However, in the face of new complex attacks (such as APT attacks, zero-day exploit), the identification accuracy and timeliness are significantly insufficient. SUMMARY

[0004] The purpose of the present application is to provide a server security risk identification method and system to improve the identification accuracy and timeliness.

[0005] To achieve the above purpose, in a first aspect, the application provides a server security risk identification method, comprising the following steps:

[0006] Multi-source data is collected using a hybrid collection mode, and the multi-source data is associated based on a pre-set association identifier;

[0007] The associated multi-source data is standardized and mapped, and a composite feature is generated according to the extracted features;

[0008] After preprocessing the composite feature, input it into a machine learning model to perform weighted calculation on the feature, and generate a risk level based on a dynamic threshold;

[0009] The risk descriptor generated based on the risk level is combined with the context state, and matched with a set of disposal rule library to generate a corresponding risk processing scheme.

[0010] Among them, multi-source data is collected using a hybrid collection mode, and the multi-source data is associated based on a pre-set association identifier, including:

[0011] System log data, network traffic data, process behavior data and external threat intelligence data are collected using a hybrid mode of lightweight agents and agentless probes;

[0012] The collected multi-source data shares a unique global request identifier and is assigned a corresponding standard timestamp, and the association is completed after conversion to a standardized ID.

[0013] The method further comprises:

[0014] The collected system log data, network traffic data, process behavior data, and external threat intelligence data are subjected to sensitive field obfuscation processing.

[0015] The associated multi-source data is subjected to standardized conversion and mapping, and composite features are generated based on the extracted features, including:

[0016] The associated multi-source data is subjected to timestamp standardization, data field standardization, and outlier cleaning in sequence to obtain unified time-series standard data.

[0017] The events of the same entity in different data sources are sorted by time using a sliding window strategy, and mapping is performed based on an identifier mapping table.

[0018] Features are extracted from the time-series standard data, and the extracted features are fused to obtain composite features.

[0019] The features are extracted from the time-series standard data, and the extracted features are fused to obtain composite features, including:

[0020] A plurality of basic features are extracted from the time-series standard data, and the plurality of basic features are converted to obtain secondary features.

[0021] The secondary features are weighted and fused using a time-series correlation fusion method to obtain composite features, and a cross-dimension feature cross method is used to perform correlation analysis on the composite features.

[0022] After preprocessing the composite features, they are input into a machine learning model for weighted calculation of the features, and a risk level is generated based on a dynamic threshold, including:

[0023] The composite features are subjected to standardization and normalization processing, and after time alignment and cross-source feature fusion, the feature vectors are input into a machine learning model.

[0024] A hierarchical collaborative computing architecture is used to calculate the risk weight of the composite features through a dynamic routing mechanism.

[0025] A risk level is generated based on a dynamic threshold.

[0026] The risk level is generated based on a dynamic threshold, including:

[0027] The initial baseline is adjusted using an exponentially weighted moving average, and a dynamic threshold is calculated by combining the baseline standard deviation and the current type.

[0028] By combining the dynamic threshold and adjustment factor, the risk weights are mapped to levels to obtain the corresponding risk levels.

[0029] Specifically, the risk descriptor generated based on the risk level, combined with the context state, is matched with a set handling rule base to generate a corresponding risk handling plan, including:

[0030] A risk descriptor is generated based on the risk level, and the context state corresponding to the current risk level is obtained synchronously.

[0031] The risk descriptor and the context state are simultaneously matched against a preset handling rule base;

[0032] The matched candidate actions are evaluated, and the results are sorted in descending order to generate a list of corresponding risk management solutions.

[0033] The method further includes:

[0034] If no rule is found to be a perfect match, similar cases are retrieved from the historical case database. The corresponding candidate actions are matched by calculating the cosine similarity between the feature vectors of the current risk descriptor and those of the historical cases.

[0035] In a second aspect, the present invention provides a server security risk identification system, which is applied to a server security risk identification method as provided in the first aspect. The server security risk identification system includes a multi-source data acquisition module, a feature fusion module, a dynamic risk analysis module, and a risk handling module.

[0036] The multi-source data acquisition module is used to acquire multi-source data using a hybrid acquisition mode and associate the multi-source data based on a preset association identifier;

[0037] The feature fusion module is used to standardize and map the associated multi-source data, and generate composite features based on the extracted features.

[0038] The dynamic risk analysis module is used to preprocess the composite features, input them into the machine learning model for weighted calculation of the features, and generate a risk level based on a dynamic threshold.

[0039] The risk handling module is used to generate a risk descriptor based on the risk level, combine it with the context state, and match it with a set handling rule base to generate a corresponding risk handling solution.

[0040] This invention discloses a server security risk identification method and system. The server security risk identification system includes a multi-source data acquisition module, a feature fusion module, a dynamic risk analysis module, and a risk handling module. It employs a hybrid acquisition mode to collect multi-source data and associates the multi-source data based on preset association identifiers. The associated multi-source data undergoes standardization transformation and mapping, and composite features are generated based on extracted features. After preprocessing the composite features, they are input into a machine learning model for weighted calculation, and a risk level is generated based on a dynamic threshold. The risk descriptor generated based on the risk level, combined with the context state, is matched with a set handling rule base to generate a corresponding risk handling scheme, improving identification accuracy and timeliness. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below.

[0042] Figure 1 This is a schematic diagram of the steps of a server security risk identification method according to the first embodiment of the present invention.

[0043] Figure 2 This is a flowchart illustrating steps S101 to S102 provided by the present invention.

[0044] Figure 3 This is a flowchart illustrating steps S103 to S104 provided by the present invention.

[0045] Figure 4 This is a schematic diagram of the structure of a server security risk identification system according to the second embodiment of the present invention.

[0046] Figure 5 This is a schematic diagram of the electronic device of the present invention.

[0047] In the diagram: 101 - Multi-source data acquisition module, 102 - Feature fusion module, 103 - Dynamic risk analysis module, 104 - Risk management module. Detailed Implementation

[0048] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application.

[0049] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0050] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0051] The first embodiment of this application is as follows:

[0052] Please see Figures 1-3 This invention provides a method for identifying server security risks, comprising the following steps:

[0053] S101. Multi-source data is collected using a hybrid acquisition mode, and the multi-source data is associated based on a preset association identifier.

[0054] Specifically, the collected multi-source data includes system log data, network traffic data, process behavior data, and external threat intelligence data. System log data includes: login authentication logs: recording user login time, source IP, login method (e.g., SSH, RDP), success / failure status, and number of attempts; permission change logs: capturing user privilege escalation (e.g., sudo operations), account creation / deletion, and group policy modification events; process call logs: monitoring process start / termination commands, parent-child process relationships, and dynamic library loading records; and file operation logs: reading, writing, deleting, and modifying operations on critical files (e.g., system configuration files, sensitive data files). Network traffic data includes: connection layer data: source / destination IP, port, protocol type (TCP / UDP / ICMP), connection status (established / disconnected), and packet size; application layer data: HTTP request headers, DNS query domain names, and SSL / TLS certificate information (e.g., abnormal certificate signatures); and traffic timing characteristics: connection frequency per unit time, sudden traffic spikes, and patterns of unconventional port access. Process behavior data includes: resource usage metrics: process CPU / memory usage, disk I / O rate, network I / O rate; behavior sequence data: process read / write sequence of external files, network connection target (IP + port), child process forking mode; abnormal call detection: unauthorized system calls (such as privileged instruction execution), sensitive API calls (such as encryption key operations). External threat intelligence includes: malicious IP / domain database: known attack source IPs, malicious domains, C&C server addresses; vulnerability signature database: attack patterns corresponding to server software vulnerabilities (such as abnormal payloads associated with CVE numbers); industry risk rules: threat models based on business types (such as common attack methods in the financial industry).

[0055] To minimize the impact on server performance and ensure compatibility, a hybrid mode of lightweight proxy and agentless probes is adopted:

[0056] System logs and process behavior collection:

[0057] Deploy a lightweight agent (named Security Data Collector) that runs as a kernel module at the underlying level of the server operating system;

[0058] Log collection: Subscribe to log streams in real time through system log interfaces (such as Linux syslog, Windows ETW), filter redundant information, and compress and transmit it;

[0059] Process monitoring: Hook system calls (such as Linux auditd, Windows ETW Provider) to capture events such as process creation and file access;

[0060] Resource usage control: The agent program uses ≤3% of CPU and memory, and the data collection interval is adjustable (default 1 second / time).

[0061] Network traffic collection:

[0062] Data collection methods: Option 1: Mirror traffic through the server's network interface card and parse network packets using an agentless probe (named Traffic Sensor); Option 2: Call cloud platform virtual network interfaces (such as AWS VPC Flow Logs, Azure NSG Flow Logs) to obtain traffic metadata.

[0063] Protocol parsing: Deep packet inspection (DPI) technology identifies application layer protocols and extracts key fields such as HTTP / DNS;

[0064] Sampling strategy: To avoid excessive traffic, full sampling is performed on low-frequency connections, while adaptive sampling is used for high-frequency connections (e.g., 10% sampling when there are more than 1000 connections per second).

[0065] External threat intelligence access:

[0066] API scheduled fetch: Synchronize third-party threat intelligence databases hourly via standard API interfaces (such as STIX / TAXII protocols);

[0067] Local caching: Establish an intelligence cache database, and prioritize querying the local cache when matching to reduce latency.

[0068] The collected multi-source data shares a unique global request identifier and is assigned a corresponding standard timestamp. At the same time, entities such as IP address, user ID, and process ID are uniformly converted into standardized IDs and then associated. The global request identifier is a unique global request identifier shared by logs, processes, and network behaviors triggered by the same user request, such as API calls, database queries, and network responses corresponding to a web request.

[0069] To address data privacy and compliance risks, it is necessary to conduct compliance and legality checks on the collected multi-source data, including the following processing steps:

[0070] Data hierarchical desensitization

[0071] Sensitive field obfuscation: Personal information (such as usernames and file paths) is hashed and desensitized, and the key is managed by the enterprise key management system;

[0072] Differentiated data collection strategy: Dynamically adjust the collection scope based on the data sensitivity level (e.g., public cloud / private cloud). For example, in a public cloud environment, only metadata is collected, not file content.

[0073] User Authorization and Auditing

[0074] Active authorization mechanism: Before deploying the data collection tool on the server, the authorization agreement must be confirmed through the administrator console to clarify the scope of data collection and the purpose of use;

[0075] Audit log recording: All data collection operations (such as agent installation and data access) are recorded in an independent audit database for review by the compliance department.

[0076] Compliance Adaptive Strategy

[0077] Regional compliance rule library: Built-in requirements of regulations such as GDPR and cybersecurity law, automatically disables non-compliant data collection items based on the server's location, such as disabling the transmission of unmasked logs in the EU region;

[0078] Data lifecycle management: Collected data is encrypted and stored for 30 days by default, and is automatically deleted after the expiration period. Custom retention periods are supported.

[0079] The hybrid agent-based and agentless modes balance deployment flexibility and data integrity; the Global Request Identifier (GRID) used enables behavior tracking mechanisms across data sources, improving the efficiency of correlation analysis.

[0080] S102. Standardize and map the associated multi-source data, and generate composite features based on the extracted features.

[0081] Specifically, firstly, the associated multi-source data is uniformly converted to the ISO 8601 extended format and time zone information is annotated. To address clock differences among distributed servers, a Network Time Protocol (NTP) deviation correction algorithm is used to synchronize the timestamps of each server to within 10 milliseconds, completing the timestamp standardization process. Then, IP addresses are uniformly converted to an IPv6-compatible format, user identifiers use the "domain name / username" format, file paths are standardized to UNIX style, numeric data is standardized to floating-point numbers, and enumerated data uses predefined encoding, completing the data field standardization process. To reduce the amount of subsequent computation on useless data, outliers are cleaned up, discarding obviously invalid data such as future timestamps and CPU usage exceeding reasonable limits. Missing numeric fields are filled with the historical average of the same entity. Finally, all data is converted to JSON format to obtain unified time-series standard data.

[0082] Build an entity identifier library: Establish unique identifier mapping tables for entities such as IP addresses, users, processes, and files.

[0083] User identifier: <domain>|<username>@<initial login IP>;

[0084] Process identifier: <hostname>|<process ID>|<startup timestamp>;

[0085] Session identifier: <source IP>:<source port>-<destination IP>:<destination port>@<protocol>.

[0086] Using a 5-minute sliding window, events of the same entity across different data sources are sorted by time. Different entities are associated through shared resources, such as multiple processes accessing the same file or different users from the same IP address. Mapping is based on an identifier mapping table, with predefined association patterns including: Login anomaly pattern: multiple failed logins → successful login → sensitive file access; Lateral movement pattern: Server A infected → scanning server B's port → new process started on server B.

[0087] Multiple basic features are extracted from the time-series standard data. These basic features are then transformed to obtain secondary features. A time-series correlation fusion method is used to weightedly fuse these secondary features to obtain composite features. Finally, a cross-dimensional feature cross-analysis method is used to perform correlation analysis on these composite features. Specifically:

[0088] First, several basic features are extracted from the time-series standard data. These basic features fall into three categories: statistical features, time-series features, and contextual features. Statistical features include, but are not limited to, the number of login failures per unit time, network connection frequency, and the mean and variance of process CPU utilization. Time-series features include indicators of the continuity of behavioral sequences, such as the coefficient of variation of the process startup interval time series. Contextual features include the external threat intelligence matching status and business cycle stage identifiers.

[0089] Next, the extracted basic features are transformed to obtain secondary features. The transformation methods include nonlinear transformation and standardized scaling: logarithmic transformation is applied to frequency data in statistical features to mitigate the influence of long-tailed distribution; the moving average and standard deviation of the interval time series in time series features are calculated to generate stability indices; and categorical variables in context features are one-hot encoded or embedded to convert them into numerical features.

[0090] Then, a time-series correlation fusion method is used to weight and fuse the secondary features to obtain composite features. During the weighted fusion process, weights are assigned based on feature importance, which is calculated by the correlation between the feature and historical risk labels: features highly correlated with known risk behaviors (such as high-frequency failed logins) are assigned higher weights; features with lower discriminative power are assigned lower weights. Weighted fusion is performed within a sliding time window, and the feature vectors within each window are fused into a composite feature vector through a weighted summation.

[0091] Finally, a cross-dimensional feature cross-analysis method is employed to perform correlation analysis on the composite features. Cross-dimensional feature cross-analysis refers to combining features from different data sources to capture the interactions between multi-source features. Specifically, this includes: cross-analyzing network traffic features with process behavior features to generate a joint "network connection-process startup" feature; and cross-analyzing external threat intelligence matching results with system log features to generate an "intelligence-log" correlation feature. The cross-analyzed features are further dimensionality-reduced using principal component analysis to retain key information, forming the final composite feature set used for risk analysis.

[0092] S103. After preprocessing the composite features, they are input into a machine learning model to perform weighted calculations on the features and generate risk levels based on dynamic thresholds.

[0093] Specifically, before inputting composite features into a machine learning model for risk weight calculation, the following preprocessing steps are required to ensure feature quality:

[0094] 1. Feature standardization and normalization

[0095] Adaptive standardization: For numerical composite features (such as traffic burst coefficient), an improved Z-Score standardization is used. Nonlinear normalization: Features sensitive to extreme values ​​(such as login-process anomaly degree) are compressed to the [0,1] interval using the Sigmoid function.

[0096] 2. Feature Dimensionality Reduction and Selection

[0097] Correlation filtering: Calculate the Pearson correlation coefficient between composite features and remove highly redundant features with a correlation coefficient > 0.85; Importance screening: Use XGBoost feature importance assessment to retain the top-100 features by importance score; Principal component analysis (PCA): Perform PCA dimensionality reduction on behavioral sequence features (such as process call sequence deviation) and retain 95% of the variance component.

[0098] 3. Timing feature alignment

[0099] Sliding window aggregation: Using a 5-minute window, calculate the following statistics for high-frequency features (such as network connections per second): maximum value, minimum value, standard deviation within the window, and the difference (Delta value) from the previous time window; Periodic pattern compensation: Introduce a time period factor for business periodic features (such as the difference in traffic on weekdays / restdays).

[0100] 4. Cross-source feature fusion

[0101] Intelligence weighted fusion: The weights of features involving external intelligence (such as intelligence matching weights) are dynamically adjusted based on the timeliness of the intelligence.

[0102] Multiple features along the same entity's behavior chain are concatenated into a feature vector, such as the full path features of user login → process startup → network connection. The notification vector is then input into a machine learning model, which employs a hierarchical collaborative computing architecture consisting of a real-time lightweight model and a deep analytics model. A dynamic routing mechanism is used to accurately calculate risk weights.

[0103] The real-time lightweight model (LightGBM architecture) is responsible for the rapid preliminary analysis of most routine, low-computational-complexity risk events. This layer processes relatively low-dimensional features with extremely short response times to meet real-time requirements. Its features handled are: 150-200 core features; response time requirement: <50 milliseconds; computation frequency: 100-1000 events per second; coverage: handling 90% of routine risk assessments.

[0104] The deep analysis model (temporal convolutional network architecture) is responsible for more refined and in-depth verification and analysis of high-risk events or complex patterns selected by the real-time analysis layer. This layer processes features with higher dimensionality, including longer temporal context information. While computationally more time-consuming, it offers higher accuracy. Its feature processing dimensions are: 500+ extended features, including temporal sequences; response time requirement: <500 milliseconds; computation frequency: 10-100 high-risk events per minute; coverage: handling 10% of complex risk verifications.

[0105] The dynamic adjustment mechanism includes a primary filtering and a priority scheduling algorithm. First, in the primary filtering, the real-time lightweight model performs preliminary calculations on the input composite feature vector to obtain a preliminary risk score and confidence level, and also outputs a risk label. Based on a preset routing strategy, for example, events with a preliminary risk level below 60 and a confidence level above 0.9 are directly output by the real-time lightweight model. If the preliminary risk score is greater than or equal to 60, or the event has a low confidence level, the priority scheduling algorithm is invoked for deep validation. The priority scheduling algorithm is a weighted calculation based on risk level, using a sum of 0.6 times the preliminary risk level and 0.4 times the confidence level to calculate the risk weight.

[0106] During dynamic threshold adjustment, two initial baselines are calculated: a behavioral baseline and a business baseline. The behavioral baseline is derived from the characteristic distribution of historical normal behavior of each server (e.g., the 90th percentile). The business baseline is derived from learning business cycle patterns (e.g., traffic peaks for e-commerce servers during promotional periods). Then, an Exponentially Weighted Moving Average (EWMA) is used to dynamically adjust the baselines. This involves multiplying the set adjustment parameter by the current parameter, and then summing the products of the initial baseline and the initial adjustment parameter. The adjustment parameter is between 0.2 and 0.3, and the sum of the initial and current adjustment parameters is 1. Based on the adjusted baselines, the dynamic threshold is obtained by multiplying the baseline standard deviation by the business parameters corresponding to the business type. Simultaneously, current adjustment factors are collected, including: a threat intelligence factor (temporarily lowering the threshold by 20% when high-risk intelligence is matched); an attack activity factor (synchronously lowering the threshold of associated servers when lateral movement is detected); and a resource load factor (raising the threshold by 15% when CPU utilization is >80% to reduce false alarms).

[0107] By combining the dynamic threshold and adjustment factors to map the risk weights into levels, corresponding risk levels are obtained. These risk levels include: extreme risk (≥90): exceeding the baseline by 3 standard deviations and matching high-risk intelligence; high risk (75-89): exceeding the baseline by 2 standard deviations or matching medium-risk intelligence; medium risk (60-74): exceeding the baseline by 1.5 standard deviations; and low risk (40-59): exceeding the baseline by 1 standard deviation. Each adjustment factor should be quantified as a weight coefficient; for example, 1.0 indicates no adjustment, 0.8 indicates a 20% reduction, and 1.15 indicates a 15% increase. The final calculation of the dynamic threshold should be based on the baseline threshold calculated using the Exponentially Weighted Moving Average (EWMA), multiplied by the product of the weight coefficients of all relevant adjustment factors. For example: final dynamic threshold = (EWMA baseline threshold) × (threat intelligence factor coefficient) × (attack activity factor coefficient) × (resource load factor coefficient). This multiplication method comprehensively reflects the combined impact of multiple contextual factors on risk sensitivity, allowing the threshold to be adjusted adaptively.

[0108] It achieves end-to-end adaptive processing from composite feature preprocessing to risk assessment, significantly improving the accuracy and timeliness of risk identification.

[0109] S104. The risk descriptor generated based on the risk level is combined with the context state and matched with the set disposal rule base to generate the corresponding risk handling plan.

[0110] Specifically, risk descriptors generated based on the risk levels include: Risk Entity Identifier: a uniformly formatted ID; Risk Level: the original risk value (0-100) calculated by the machine learning model; Risk Tag Set: identifying the risk type; Confidence Score: the model's predicted confidence score (0-1); Feature Vector: key features leading to high risk and their contribution. Simultaneously, the current system context state is collected and integrated in real time as a crucial input for decision-making: Business Status: the current business time period (peak / off-peak), and the criticality level of affected businesses (obtained from the CMDB system); System Load: the current CPU, memory, and disk I / O utilization of the server; Network Topology: the location of the risk entity in the network (border / core area), and critical connections; Threat Intelligence Confidence Score: the timeliness and reliability score of the threat intelligence that triggers the alert.

[0111] The pre-defined rule base uses a condition-action model. The condition is that the risk score is greater than the threshold, and the risk label is ANDed with the context state to obtain the corresponding action. The condition part should consist of multiple sub-conditions combined using "AND" or "OR" logical operators. Each sub-condition targets a dimension of the risk descriptor (e.g., risk level > 75, risk label contains "lateral movement") or a dimension of the context state (e.g., business status = "peak hours", affected business criticality level = "P1").

[0112] The matching process involves logically matching the risk descriptor and system context state of the current event against the conditional portion of each rule in the rule base. A rule whose conditions are met is considered a successful match, and its corresponding action will be activated as a candidate solution.

[0113] For one or more matched candidate actions, a cost-benefit assessment is performed to select the optimal solution. Benefit estimation: Predicts whether the action can effectively contain the threat (based on historical success rates) and how much potential loss it can reduce, based on the following dimensions: Risk reduction score: Based on historical data, the expected success rate of the action in containing the current type of risk (0%-100%); Potential loss reduction score: Based on the criticality level of the affected business (obtained from CMDB), the estimated economic or reputational loss that the action can avoid is converted into a score of 0-100; Total benefit: Equals risk reduction score × potential loss reduction score. Benefit-cost ratio = Total benefit / Total cost. The system will ultimately rank the candidate solutions in descending order according to this ratio and recommend the solution with the highest ratio. Cost estimation: Estimates the business impact (such as downtime, performance degradation), resource consumption, and execution complexity of the action, based on the following dimensions: Business impact score: Estimates the potential service downtime, increase in request latency, and degree of user experience degradation caused by the action, converted into a score of 0-100 (the higher the score, the greater the impact). Resource Consumption Score: Estimated computational, storage, and network resources required to execute the action, converted into a score of 0-100. Execution Complexity Score: Estimated degree of automation and failure risk of the action, converted into a score of 0-100.

[0114] Total cost = Business impact score × W1 + Resource consumption score × W2 + Execution complexity score × W3, where W1, W2, and W3 are predefined weighting coefficients, ranging from 0 to 1, and their sum is 1. Decision generation: Select the action or combination of actions (action chain) with the highest cost-benefit ratio. The final generated action plan explicitly includes:

[0115] Action target: accurate to entity identifier;

[0116] Action types: such as blocking, downgrading, monitoring

[0117] Execution parameters: such as blocking duration and degradation level;

[0118] Execution order: If there are multiple actions, define their dependencies and timing;

[0119] Expected outcome: The desired security objectives;

[0120] Rollback conditions: Under what conditions will this action be automatically revoked?

[0121] If no exact match is found, similar cases are retrieved from the historical case database. Similarity is calculated by using the cosine similarity between the feature vectors of the current risk descriptor and historical cases. After retrieving multiple similar cases, these historical cases form a candidate case set. For each action in this set, the system calculates two metrics: historical success rate (number of times the action was executed and marked as successful / total number of times the action was executed) and average benefit-cost ratio. Subsequently, the system sorts all different action options (after deduplication) based on weighted scores. The weighted score can consider similarity weights; for example, the score for an action = ∑(cosine similarity between each case recommending the action and the current event × success rate of this action in that case). Finally, the system generates a list of candidate action plans sorted in descending order of weighted scores for security analysts to use in decision-making or for automated systems. Simultaneously, the action results (such as false alarm correction and attack confirmation) are fed back into the machine learning model to optimize model parameters.

[0122] A structured risk descriptor is defined, encapsulating complex risk analysis results into standardized data objects, achieving loose coupling and high cohesion between the risk analysis module and the response mapping module. It integrates multi-dimensional data such as logs, traffic, and process behavior, and uncovers potential threats through correlation analysis; it dynamically calculates risk weights based on machine learning models, replacing static thresholds to reduce false alarm rates, establishing a closed-loop mechanism for risk identification and response, automatically generating and executing response strategies, and updating model parameters through a continuous learning mechanism to adapt to new attack patterns.

[0123] The second embodiment of this application is as follows:

[0124] Please see Figure 4 The present invention provides a server security risk identification system, which is applied to a server security risk identification method as provided in the first embodiment. The server security risk identification system includes a multi-source data acquisition module 101, a feature fusion module 102, a dynamic risk analysis module 103, and a risk handling module 104.

[0125] The multi-source data acquisition module 101 is used to acquire multi-source data in a hybrid acquisition mode and associate the multi-source data based on a preset association identifier;

[0126] The feature fusion module 102 is used to standardize and map the associated multi-source data, and generate composite features based on the extracted features.

[0127] The dynamic risk analysis module 103 is used to preprocess the composite features, input them into the machine learning model for weighted calculation of the features, and generate a risk level based on a dynamic threshold.

[0128] The risk handling module 104 is used to generate a risk descriptor based on the risk level, combine it with the context state, and match it with a set handling rule base to generate a corresponding risk handling solution.

[0129] Regarding the system in the above embodiments, the specific ways in which each module performs operations have been described in detail in the embodiments related to the method, and will not be elaborated here.

[0130] For the system embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this application according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0131] Accordingly, this application also provides an electronic device, including: one or more processors; a memory for storing one or more programs; and when the one or more programs are executed by the one or more processors, causing the one or more processors to implement the server security risk identification method described above. Figure 5 The diagram shown is a hardware structure diagram of any data processing-capable device where a server security risk identification system provided by an embodiment of the present invention is located. (Except for...) Figure 5 In addition to the processor, memory, and network interface shown, any data processing device in the embodiment may also include other hardware depending on the actual function of the data processing device, which will not be described in detail here.

[0132] Accordingly, this application also provides a computer-readable storage medium storing computer instructions thereon, which, when executed by a processor, implement the server security risk identification method described above. The computer-readable storage medium can be an internal storage unit of any data-processing device as described in any of the foregoing embodiments, such as a hard disk or memory. The computer-readable storage medium can also be an external storage device, such as a plug-in hard disk, smart media card (SMC), SD card, flash card, etc., equipped on the device. Furthermore, the computer-readable storage medium can include both internal storage units of any data-processing device and external storage devices. The computer-readable storage medium is used to store the computer program and other programs and data required by the data-processing device, and can also be used to temporarily store data that has been output or will be output.

[0133] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the disclosure herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein.

[0134] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope.

Claims

1. A method for identifying server security risks, characterized in that, Includes the following steps: A hybrid acquisition mode is used to collect multi-source data, and the multi-source data is associated based on a preset association identifier; The associated multi-source data is standardized, transformed, and mapped, and composite features are generated based on the extracted features. After preprocessing the composite features, they are input into a machine learning model for weighted calculation of the features, and a risk level is generated based on a dynamic threshold. The risk descriptor generated based on the risk level, combined with the context state, is matched with the set handling rule base to generate the corresponding risk handling plan.

2. The server security risk identification method as described in claim 1, characterized in that, A hybrid acquisition mode is used to collect multi-source data, and the multi-source data is associated based on preset association identifiers, including: The system uses a hybrid mode of lightweight agent and agentless probe to collect system log data, network traffic data, process behavior data, and external threat intelligence data. The collected multi-source data share a unique global request identifier, are assigned a corresponding standard timestamp, and are then converted into a standardized ID to complete the association.

3. The server security risk identification method as described in claim 2, characterized in that, The method further includes: Sensitive fields in the collected system log data, network traffic data, process behavior data, and external threat intelligence data are obfuscated.

4. The server security risk identification method as described in claim 1, characterized in that, The associated multi-source data is standardized, transformed, and mapped, and composite features are generated based on the extracted features, including: After performing timestamp standardization, data field standardization, and outlier cleaning on the associated multi-source data, unified time-series standard data is obtained. A sliding window strategy is used to sort events of the same entity from different data sources by time and map them based on an identifier mapping table; Feature extraction is performed on the time-series standard data, and the extracted features are fused to obtain composite features.

5. The server security risk identification method as described in claim 4, characterized in that, Feature extraction is performed on the time-series standard data, and the extracted features are fused to obtain composite features, including: Multiple basic features are extracted from the time-series standard data, and the multiple basic features are transformed to obtain secondary features; The secondary features are weighted and fused using a temporal correlation fusion method to obtain composite features, and the composite features are then analyzed for correlation using a cross-dimensional feature cross-analysis method.

6. The server security risk identification method as described in claim 1, characterized in that, After preprocessing the composite features, they are input into a machine learning model for weighted calculation of the features, and a risk level is generated based on a dynamic threshold, including: The composite features are standardized and normalized, and after time alignment and cross-source feature fusion, the feature vectors are input into the machine learning model. A hierarchical collaborative computing architecture is adopted, and the risk weight of the composite feature is calculated through a dynamic routing mechanism; Risk levels are generated based on dynamic thresholds.

7. The server security risk identification method as described in claim 6, characterized in that, Risk levels are generated based on dynamic thresholds, including: The initial baseline is adjusted using an exponentially weighted moving average, and a dynamic threshold is calculated by combining the baseline standard deviation and the current type. By combining the dynamic threshold and adjustment factor, the risk weights are mapped to levels to obtain the corresponding risk levels.

8. The server security risk identification method as described in claim 1, characterized in that, The risk descriptor generated based on the risk level, combined with the context state, is matched with the established handling rule base to generate a corresponding risk handling plan, including: A risk descriptor is generated based on the risk level, and the context state corresponding to the current risk level is obtained synchronously. The risk descriptor and the context state are simultaneously matched against a preset handling rule base; The matched candidate actions are evaluated, and the results are sorted in descending order to generate a list of corresponding risk management solutions.

9. The server security risk identification method as described in claim 8, characterized in that, The method further includes: If no rule is found to be a perfect match, similar cases are retrieved from the historical case database. The corresponding candidate actions are matched by calculating the cosine similarity between the feature vectors of the current risk descriptor and those of the historical cases.

10. A server security risk identification system, applied to the server security risk identification method as described in claim 1, characterized in that, The server security risk identification system includes a multi-source data acquisition module, a feature fusion module, a dynamic risk analysis module, and a risk handling module; The multi-source data acquisition module is used to acquire multi-source data using a hybrid acquisition mode and associate the multi-source data based on a preset association identifier; The feature fusion module is used to standardize and map the associated multi-source data, and generate composite features based on the extracted features. The dynamic risk analysis module is used to preprocess the composite features, input them into the machine learning model for weighted calculation of the features, and generate a risk level based on a dynamic threshold. The risk handling module is used to generate a risk descriptor based on the risk level, combine it with the context state, and match it with a set handling rule base to generate a corresponding risk handling solution.

Images