Cloud computer abnormal behavior detection method and device, electronic equipment and storage medium

Abstract

The invention provides a method for detecting abnormal behaviors of a cloud computer, and the method comprises the steps: collecting a multi-modal data stream in the running process of the cloud computer in real time, the multi-modal data stream comprising a user operation behavior sequence, system resource occupation time sequence data and network flow data; performing real-time feature extraction and cross-modal fusion on the multi-modal data stream to generate a fused multi-dimensional behavior feature vector; the multi-dimensional behavior feature vector is input into an abnormal behavior detection model obtained through multi-scene federated learning training, and the abnormal behavior detection model adaptively adjusts a judgment threshold according to the current application scene and outputs an abnormal judgment result and an abnormal type identifier; and when the abnormal behavior is judged, generating a grading response strategy according to an abnormal type and executing corresponding operation. The problems that the detection range of an existing detection method is limited, the situation of missing report or false report exists, and the abnormal behavior detection precision of the cloud computer is low can be solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of cloud computers, and particularly relates to a cloud computer abnormal behavior detection method and device, electronic equipment and a storage medium. BACKGROUND

[0002] Cloud computing can integrate thousands of hardware servers into a shared resource pool and configure computing resources of virtual machines on demand through virtualization technology. A cloud platform can manage tens of thousands of virtual machines. Timely and accurately discovering abnormalities and faults occurring in the running of virtual machines is an important task in virtual machine management. At present, the operation and maintenance management of cloud computers mainly focuses on monitoring and alarming, including analyzing the running state by using detection tools, deploying software and updating patches, and the user decides the subsequent processing flow after receiving the abnormal alarm. Therefore, the detection range of the existing traditional detection method is limited, there are missed reports or false reports, and the abnormal behavior detection accuracy of the cloud computer is low. SUMMARY

[0003] The present application provides a cloud computer abnormal behavior detection method, which aims to solve the problem of limited detection range of the existing detection method, missed reports or false reports, and low abnormal behavior detection accuracy of the cloud computer. By performing real-time feature extraction and cross-modal fusion on the real-time collected multi-modal data stream in the running process of the cloud computer, a fused multi-dimensional behavior feature vector is generated, the multi-dimensional behavior feature vector is input into an abnormal behavior detection model trained by multi-scene federated learning, the abnormal behavior detection model adaptively adjusts the discrimination threshold according to the current application scenario, and outputs the abnormal discrimination result and the abnormal type identification. When the behavior is determined to be abnormal, a hierarchical response strategy is generated according to the abnormal type and the corresponding operation is performed, which solves the problem of limited detection range of the existing detection method, missed reports or false reports, and low abnormal behavior detection accuracy of the cloud computer.

[0004] In a first aspect, the present application provides a cloud computer abnormal behavior detection method, which comprises the following steps:

[0005] Real-time collection of multi-modal data stream in the running process of the cloud computer, wherein the multi-modal data stream comprises user operation behavior sequence, system resource occupation time series data and network traffic data;

[0006] Real-time feature extraction and cross-modal fusion are performed on the multi-modal data stream to generate a fused multi-dimensional behavior feature vector;

[0007] The multi-dimensional behavior feature vector is input into an abnormal behavior detection model trained by multi-scene federated learning, the abnormal behavior detection model adaptively adjusts the discrimination threshold according to the current application scenario, and outputs the abnormal discrimination result and the abnormal type identification;

[0008] When the abnormal behavior is determined, a hierarchical response strategy is generated according to the type of the abnormal behavior, and a corresponding operation is performed.

[0009] Optionally, the real-time feature extraction and cross-modal fusion on the multi-modal data stream to generate a fused multi-dimensional behavior feature vector comprises:

[0010] The spatio-temporal features in the user operation behavior sequence, the semantic features in the system resource occupation time series data, and the fluctuation pattern features in the network traffic data are respectively extracted through parallel processing channels, wherein the spatio-temporal features are extracted using a 3D convolutional neural network, the semantic features are extracted using a bidirectional long short-term memory network, and the fluctuation pattern features are extracted using a one-dimensional convolutional neural network in cooperation with a self-attention mechanism.

[0011] The above features are aligned and weighted fused using a fusion module based on an attention mechanism, the fusion module calculates the attention weights of each feature modality, and performs weighted summation according to the weights to generate a multi-dimensional behavior feature vector with scene awareness.

[0012] Optionally, the training of the abnormal behavior detection model comprises:

[0013] Based on the historical behavior data of each application scenario, a dynamic abnormality coefficient of abnormal behavior is calculated, which is obtained by weighted fusion of behavior frequency, resource occupation deviation, and associated security event level, wherein the weights are pre-set according to the scene type and empirical knowledge;

[0014] According to the dynamic abnormality coefficient and the scene context, the nature of the abnormality is determined, and a multi-scene and multi-modal training sample set is constructed, the sample set including positive samples, negative samples, and difficult example samples;

[0015] An initial multi-modal model is trained in a distributed manner on each cloud computer node using a federated learning framework, each node trains the model using local data and uploads the model parameters to a central server, the central server aggregates the parameter updates of each node using the FedAvg algorithm to update the global model, wherein an incremental learning mechanism is introduced during the model training process, and the model is fine-tuned periodically using new scene data to adapt to the distribution changes.

[0016] Optionally, the model adaptively adjusts the discrimination threshold according to the current application scenario, comprising:

[0017] Real-time scene metadata is obtained, including scene key level, real-time risk state, and user identity and permission;

[0018] The scene metadata is input into a pre-configured threshold adjustment rule engine, and the rule engine outputs a discrimination threshold adjustment amount for the current scene;

[0019] The sensitivity and threshold of the abnormality discrimination are dynamically adjusted according to the adjustment amount, wherein a high-risk scenario corresponds to a lower threshold to improve the detection sensitivity.

[0020] Optionally, the method further comprises:

[0021] After detecting the abnormal behavior, complete multi-modal context data of the abnormal behavior is recorded, including a user operation behavior sequence, system resource occupation time series data and network traffic data within a preset time window before the abnormal behavior;

[0022] The recorded context data is desensitized and encrypted, and is returned to a cloud computer management platform, for model iteration optimization and abnormality analysis.

[0023] Optionally, the generation of the hierarchical response strategy according to the abnormal type comprises:

[0024] A predefined mapping relationship between the abnormal type and the risk level, and a response operation corresponding to each risk level;

[0025] According to the abnormal type identifier, the mapping table is queried to determine the risk level, if it is a low risk, a record log operation is generated, if it is a medium risk, real-time alarm is triggered and behavior monitoring is started, if it is a high risk, the session is interrupted, behavior is intercepted or an artificial review process is started;

[0026] After the response operation is executed, a disposal report is generated and sent to an administrator.

[0027] Optionally, the real-time collection of the multi-modal data stream comprises:

[0028] A lightweight collection agent deployed in the cloud computer instance is used to synchronously capture the user operation behavior sequence, the system resource occupation time series data and the network traffic data at a preset sampling frequency;

[0029] The collection agent losslessly compresses and AES encrypts the user operation behavior sequence, the system resource occupation time series data and the network traffic data, and then transmits them to the detection engine through a special data channel.

[0030] In a second aspect, the embodiments of the present application further provide a cloud computer abnormal behavior detection device, comprising:

[0031] A collection module is configured to collect multi-modal data streams in a cloud computer running process in real time, wherein the multi-modal data streams comprise a user operation behavior sequence, system resource occupation time series data and network traffic data;

[0032] A generation module is configured to perform real-time feature extraction and cross-modal fusion on the multi-modal data streams to generate a fused multi-dimensional behavior feature vector;

[0033] The training module is configured to input the multi-dimensional behavior feature vector into an abnormal behavior detection model trained by multi-scene federated learning, and the abnormal behavior detection model is configured to adaptively adjust a discrimination threshold according to a current application scenario, and output an abnormal discrimination result and an abnormal type identifier.

[0034] The processing module is configured to generate a hierarchical response strategy according to the abnormal type and perform corresponding operations when the behavior is determined to be abnormal.

[0035] In a third aspect, an electronic device is provided, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the steps in the cloud computer abnormal behavior detection method provided by the embodiments of the present application when executing the computer program.

[0036] In a fourth aspect, a computer readable storage medium is provided, which stores a computer program, and the computer program implements the steps in the cloud computer abnormal behavior detection method provided by the embodiments of the present application when executed by a processor.

[0037] In the embodiments of the present application, multi-modal data streams in the running process of the cloud computer are collected in real time, the multi-modal data streams include user operation behavior sequences, system resource occupation time series data, and network traffic data; real-time feature extraction and cross-modal fusion are performed on the multi-modal data streams to generate a fused multi-dimensional behavior feature vector; the multi-dimensional behavior feature vector is input into an abnormal behavior detection model trained by multi-scene federated learning, the abnormal behavior detection model adaptively adjusts a discrimination threshold according to a current application scenario, and outputs an abnormal discrimination result and an abnormal type identifier; when the behavior is determined to be abnormal, a hierarchical response strategy is generated according to the abnormal type and corresponding operations are performed. The present application solves the problems of limited detection range, missed or false reports of existing detection methods, and low accuracy of abnormal behavior detection of the cloud computer by collecting multi-modal data streams in the running process of the cloud computer in real time, performing real-time feature extraction and cross-modal fusion on the multi-modal data streams to generate a fused multi-dimensional behavior feature vector, inputting the multi-dimensional behavior feature vector into an abnormal behavior detection model trained by multi-scene federated learning, the abnormal behavior detection model adaptively adjusting a discrimination threshold according to a current application scenario, and outputting an abnormal discrimination result and an abnormal type identifier, and generating a hierarchical response strategy according to the abnormal type and performing corresponding operations when the behavior is determined to be abnormal. BRIEF DESCRIPTION OF DRAWINGS

[0038] In order to make the technical solutions of the embodiments of the present application or the prior art clearer, the accompanying drawings needed in the embodiments or prior art description will be briefly introduced. Obviously, the accompanying drawings in the following description only represent some of the embodiments of the present application, and other drawings can be obtained by those of ordinary skill in the art without any creative effort based on these drawings.

[0039] Figure 1 is a flow chart of a cloud computer abnormal behavior detection method provided by an embodiment of the present application;

[0040] Figure 2 is a structural schematic diagram of a cloud computer abnormal behavior detection device provided by an embodiment of the present application;

[0041] Figure 3 is a structural schematic diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0042] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments only represent some of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without any creative effort belong to the protection scope of the present application.

[0043] As shown in Figure 1 , Figure 1 is a flow chart of a cloud computer abnormal behavior detection method provided by an embodiment of the present application. The cloud computer abnormal behavior detection method comprises the following steps:

[0044] 101, collecting multi-modal data streams in a cloud computer running process in real time.

[0045] In the embodiments of the present application, the cloud computer abnormal behavior detection method described above can be applied to a cloud computer. The cloud computer is a virtual desktop service based on cloud computing technology, which migrates the computing, storage and running environment of a traditional personal computer to a cloud server. A user can access a cloud computer with complete functions through a light terminal device (such as a notebook, a tablet or a mobile phone) connected to a network.

[0046] The multi-modal data stream includes a user operation behavior sequence, system resource occupation time series data, and network traffic data. The user operation behavior sequence can be understood as a record of user operations on the cloud computer, such as opening a file, running a program, browsing a webpage, etc. The system resource occupation time series data can be understood as a record of system resource utilization in time sequence, such as the utilization rate of resources such as CPU, memory, etc. The network traffic data can be understood as the amount of data transmitted in the network, and the network traffic data is a key indicator for measuring network usage and load.

[0047] It should be noted that during the running of the cloud computer, multi-modal data streams during the running of the cloud computer can be continuously collected, including user operation behavior sequences, system resource occupation time series data, and network traffic data. The multi-modal data stream data during the running of the cloud computer can help analyze the performance of the cloud computer, optimize user experience, and perform security monitoring, etc.

[0048] 102. Real-time feature extraction and cross-modal fusion are performed on the multi-modal data stream to generate a fused multi-dimensional behavior feature vector.

[0049] In the embodiment of the application, real-time feature extraction can be performed on the multi-modal data stream to obtain multi-modal features, and the multi-modal features are cross-modal fused to generate a fused multi-dimensional behavior feature vector.

[0050] The real-time feature extraction can be understood as a process of extracting multi-modal features from the multi-modal data stream.

[0051] The cross-modal fusion can be understood as a process of integrating multi-modal features to generate a multi-dimensional behavior feature vector.

[0052] The fused multi-dimensional behavior feature vector can be a vector obtained by integrating multi-modal features. The fused multi-dimensional behavior feature vector contains information of the multi-modal data stream.

[0053] 103. The multi-dimensional behavior feature vector is input into an abnormal behavior detection model trained by multi-scene federated learning. The abnormal behavior detection model adaptively adjusts a discrimination threshold according to the current application scenario, and outputs an abnormal discrimination result and an abnormal type identifier.

[0054] In the embodiment of the application, the federated learning (Federated Learning) is a distributed machine learning technology, which realizes joint modeling across data sources while protecting data privacy by completing model training locally and uploading only encrypted model parameters or gradients. The multi-scene federated learning can be understood as applying federated learning technology in multiple different scenes, realizing cross-scene collaborative training by distributing model parameters instead of sharing original data.

[0055] The abnormal behavior detection model can be an abnormal behavior detection model constructed based on deep learning or machine learning, such as a CNN, an RNN, or the like. The abnormal behavior detection model is a model trained through multi-scene federated learning, and can adaptively adjust a discrimination threshold according to a current application scenario, identify an abnormal discrimination result and an abnormal type identifier.

[0056] The adaptive adjustment of the discrimination threshold can be understood as that the abnormal behavior detection model can automatically adjust the threshold according to the current application scenario to more accurately identify abnormal behavior.

[0057] The abnormal discrimination result can be abnormal data identified by the abnormal behavior detection model according to the adaptive adjustment of the discrimination threshold according to the current application scenario.

[0058] The abnormal type identifier is a classification identifier used to indicate an abnormal category.

[0059] In a possible embodiment, for example, the abnormal behavior detection model identifies that the operation behavior sequence of the user is significantly different from a normal mode or that system resource occupation or network traffic is abnormal according to the adaptive adjustment of the discrimination threshold according to the current application scenario, and determines that the operation behavior of the user is abnormal.

[0060] 104. When the behavior is determined to be abnormal, a hierarchical response strategy is generated according to the abnormal type and corresponding operations are performed.

[0061] In the embodiments of the present application, the abnormal type can be different types of abnormal behavior identified according to user behavior data, such as operation behavior abnormality, system resource occupation abnormality, network traffic abnormality, and the like.

[0062] The hierarchical response strategy can be different levels of countermeasures formulated according to the severity and urgency of the abnormal type. Specifically, the abnormal behavior can be divided into different levels, such as slight, moderate, severe, and the like, and then corresponding operations can be taken, such as issuing a warning, limiting permissions, disconnecting, and the like.

[0063] In a possible embodiment, for example, if the operation behavior sequence of the user is significantly different from the normal mode, the operation permission of the user will be limited; if the network traffic is abnormal, the network connection of the user will be disconnected.

[0064] It should be noted that when the behavior is determined to be abnormal, different countermeasures can be formulated according to different types of abnormal behavior, such as issuing a warning, limiting permissions, or even disconnecting, and the like.

[0065] In the embodiment of the present application, multi-modal data streams in the running process of the cloud computer are collected in real time, the multi-modal data streams include user operation behavior sequences, system resource occupation time series data and network traffic data; real-time feature extraction and cross-modal fusion are performed on the multi-modal data streams to generate a fused multi-dimensional behavior feature vector; the multi-dimensional behavior feature vector is input into an abnormal behavior detection model trained by multi-scene federated learning, the abnormal behavior detection model adaptively adjusts the discrimination threshold according to the current application scene, and outputs an abnormal discrimination result and an abnormal type identifier; when the discrimination is an abnormal behavior, a hierarchical response strategy is generated according to the abnormal type and corresponding operations are performed. Through real-time feature extraction and cross-modal fusion on the multi-modal data streams collected in the running process of the cloud computer, a fused multi-dimensional behavior feature vector is generated, the multi-dimensional behavior feature vector is input into an abnormal behavior detection model trained by multi-scene federated learning, the abnormal behavior detection model adaptively adjusts the discrimination threshold according to the current application scene, and outputs an abnormal discrimination result and an abnormal type identifier, when the discrimination is an abnormal behavior, a hierarchical response strategy is generated according to the abnormal type and corresponding operations are performed, solving the problem of limited detection range of the existing detection method, the existence of false negative or false positive, and the low precision of abnormal behavior detection of the cloud computer.

[0066] It can be understood that in the specific embodiments of the present application, data related to multi-modal data, operation behavior data, network traffic data, user data, etc. are involved, and when the embodiments in the present application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of related data, as well as the training, deployment and calling of algorithm models, need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0067] Optionally, in the step of real-time feature extraction and cross-modal fusion on the multi-modal data streams to generate a fused multi-dimensional behavior feature vector, the spatio-temporal features in the user operation behavior sequences, the semantic features in the system resource occupation time series data and the fluctuation pattern features in the network traffic data can be respectively extracted through parallel processing channels, wherein the spatio-temporal features are extracted using a 3D convolutional neural network, the semantic features are extracted using a bidirectional long short-term memory network, and the fluctuation pattern features are extracted using a one-dimensional convolutional neural network with a self-attention mechanism; the above features are aligned and weighted fused by using a fusion module based on an attention mechanism, the fusion module calculates the attention weights of each feature modality, and performs weighted summation according to the weights to generate a multi-dimensional behavior feature vector with scene perception.

[0068] In the embodiment of the present application, the above parallel processing channels can be understood as a way of processing different data streams or tasks simultaneously by multiple processors or nodes to improve processing speed and efficiency.

[0069] The multi-modal data stream includes user operation behavior sequence, system resource occupation time series data, and network traffic data. The user operation behavior sequence can be understood as the operation record of the user on the cloud computer, such as opening a file, running a program, browsing a webpage, etc. The system resource occupation time series data can be understood as the system resource utilization record in time sequence, such as the utilization rate of resources such as CPU, memory, etc. The network traffic data can be understood as the amount of data transmitted in the network, and the network traffic data is a key indicator for measuring network usage and load.

[0070] The spatio-temporal feature can be understood as a time and space feature. The spatio-temporal feature is a key indicator for describing the motion state of an object changing with time, mainly including dynamic characteristics such as speed and acceleration, and the influence of material structure on space-time.

[0071] The semantic feature can reflect the meaning of the system resource occupation time series data and the relationship between them.

[0072] The fluctuation pattern feature can reflect the repeatability and fluctuation degree of the network traffic data in time.

[0073] The three-dimensional convolutional neural network (3D-CNN) is an extension of the convolutional neural network (CNN), which increases the time dimension processing capability for spatio-temporal sequence data processing. The core structure of the three-dimensional convolutional neural network includes convolutional layers, pooling layers, and fully connected layers, but the input data is a four-dimensional array (height x width x time x channel), and the convolution kernel slides in three dimensions to extract features.

[0074] The bidirectional long short-term memory network (BiLSTM) is an improved recurrent neural network (RNN) that combines forward and backward LSTM networks to capture the bidirectional dependency relationship of sequence data.

[0075] The one-dimensional convolutional neural network with self-attention mechanism is used to process sequence data by combining local feature extraction and global dependency modeling. The self-attention mechanism dynamically adjusts the weight of each position by calculating the correlation between different positions in the sequence. The one-dimensional convolutional neural network (1D-CNN) is a neural network used to process sequence data, and the core of the one-dimensional convolutional neural network is to extract features from the input sequence through a one-dimensional convolution kernel.

[0076] The fusion module based on the attention mechanism is used to align and weight the multi-modal data stream. The fusion module based on the attention mechanism calculates the attention weight of each feature mode, and performs weighted summation according to the weight to generate a multi-dimensional behavior feature vector with scene perception.

[0077] The above alignment-weighted fusion can be understood as a process of generating a multi-dimensional behavioral feature vector with scene awareness by calculating the attention weights of each feature modality, summing them according to the weights.

[0078] The above weighted summation can be understood as a process of assigning weights to each data item, multiplying them by the corresponding values, and then summing them to obtain a comprehensive result.

[0079] The aforementioned multi-dimensional behavioral feature vectors can capture information from different modalities and are scene-aware multi-dimensional behavioral feature vectors.

[0080] It should be noted that features of multimodal data streams can be extracted and aligned and weighted using an attention-based fusion module to generate scene-aware multidimensional behavioral feature vectors.

[0081] Optionally, in the training step of the abnormal behavior detection model, a dynamic anomaly coefficient can be calculated based on historical behavior data of each application scenario. This coefficient is obtained by weighted fusion of behavior frequency, resource usage deviation, and associated security event level, where the weights are preset according to scenario type and empirical knowledge. The nature of the anomaly is determined based on the dynamic anomaly coefficient and scenario context, and a multi-scenario, multi-modal training sample set is constructed, including positive samples, negative samples, and hard sample samples. The initial multi-modal model is trained in a distributed manner on each cloud computer node using a federated learning framework. Each node uses local data to train the model and uploads the model parameters to the central server. The central server uses the FedAvg algorithm to aggregate the parameters of each node and update the global model. An incremental learning mechanism is introduced during the model training process to fine-tune the model periodically using new scenario data to adapt to distribution changes.

[0082] In this embodiment of the invention, the aforementioned historical behavior data may be past behavior data from various application scenarios, such as historical user operation records and historical system resource usage.

[0083] The dynamic anomaly coefficient of the aforementioned abnormal behavior is obtained through weighted fusion behavior frequency, resource usage deviation, and associated security event level, where the weights are preset based on scenario type and experiential knowledge. The weighted fusion behavior frequency can be understood as the total number of times the weighted fusion behavior occurs. The deviation is an indicator measuring the degree of difference between actual and target data; the resource usage deviation measures the degree of difference between actual and expected resource usage, used to assess resource utilization efficiency. The associated security event level can be understood as associating different security events with different security event levels; different security events are associated with different security levels. The weights reflect the importance of the dynamic anomaly coefficient in the overall evaluation. These weights are preset based on scenario type and experiential knowledge. The scenario type can be different categories of scenarios. The experiential knowledge can be direct cognition gained through practice, including skills and feelings.

[0084] The above scenario context can be understood as the environmental factors that influence behavior and decision-making within the scenario.

[0085] The aforementioned anomalies can be understood as significant deviations between the data or behavior and expectations.

[0086] The positive samples mentioned above can be normal behavioral data, the negative samples mentioned above can be understood as abnormal behavioral data, and the difficult samples mentioned above can be understood as samples that are difficult to be correctly identified or classified by the model, and have complex, ambiguous or abnormal characteristics.

[0087] The federated learning framework described above can train models collaboratively across multiple clients while protecting data privacy.

[0088] The initial multimodal model mentioned above can be a multimodal model built based on deep learning or machine learning, such as CLIP, LLM, etc.

[0089] The FedAvg algorithm described above is the core algorithm of federated learning. The core idea of ​​the FedAvg algorithm is to distribute the global model parameters to each client. After the client trains on local data, it uploads updated parameters. The server calculates the weighted average and updates the global model, iterating until convergence.

[0090] The core of the aforementioned incremental learning mechanism lies in the fact that the model can retain existing knowledge while processing new data, and at the same time absorb new information and optimize model performance.

[0091] It should be noted that by collecting historical behavioral data from different application scenarios, the dynamic anomaly coefficient of abnormal behavior can be calculated. Based on the dynamic anomaly coefficient and the scenario context, the nature of the anomaly can be determined, a training sample set can be constructed, and an initial multimodal model can be trained in a distributed manner on each cloud computer node using a federated learning framework. Each node uses local data to train the model and uploads the model parameters to the central server. The central server uses the FedAvg algorithm to aggregate the parameters of each node and update the global model. An incremental learning mechanism is introduced during the model training process, and the model is fine-tuned periodically using new scenario data to adapt to changes in distribution.

[0092] Optionally, in the step of the model adaptively adjusting the discrimination threshold according to the current application scenario, scene metadata can be obtained in real time, including the scene's critical level, real-time risk status, and user identity and permissions; the scene metadata can be input into a pre-configured threshold adjustment rule engine, and the rule engine can output the discrimination threshold adjustment amount for the current scenario; the sensitivity and threshold of anomaly discrimination can be dynamically adjusted according to the adjustment amount, with lower thresholds corresponding to high-risk scenarios to improve detection sensitivity.

[0093] In this embodiment of the invention, the aforementioned scene metadata can be understood as data describing scene characteristics. Scene metadata includes scene criticality level, real-time risk status, and user identity and permissions. The aforementioned scene criticality level can be understood as an assessment of the importance or urgency of the scene. The aforementioned real-time risk status can be understood as the risk situation that changes over time. It should be noted that the risk status directly impacts the scene and needs to be identified and addressed promptly. The aforementioned user identity and permissions can be understood as the scope of permissions a user is allowed to perform within the system.

[0094] The aforementioned pre-configured thresholds are pre-set thresholds used to dynamically adjust the rule engine.

[0095] The rule engine outputs the adjustment amount of the discrimination threshold for the current scene.

[0096] The sensitivity of the above anomaly detection can be understood as the degree of response to different situations when detecting anomalies.

[0097] The above-mentioned threshold for anomaly detection is used to distinguish between normal and abnormal behavior.

[0098] It should be noted that the system can obtain the scene's critical level, real-time risk status, and user identity and permissions in real time. These information can be input into the rule engine, which can calculate the threshold adjustment amount for the current scene based on pre-configured rules. The sensitivity and threshold of anomaly detection can be dynamically changed based on the adjustment amount. In high-risk scenes, a lower threshold is used to improve detection sensitivity.

[0099] Optionally, the method for detecting abnormal behavior of cloud computers can also record the complete multimodal context data of the abnormal behavior after it is detected, including the user operation behavior sequence, system resource usage time series data, and network traffic data within a preset time window before the abnormality; the recorded context data is desensitized and encrypted, and then sent back to the cloud computer management platform for model iteration optimization and anomaly analysis.

[0100] In this embodiment of the invention, the complete multimodal context data of the aforementioned abnormal behavior includes a sequence of user operation behaviors within a preset time window prior to the anomaly, system resource usage time-series data, and network traffic data. The preset time window can be a pre-set time window. Within the preset time window, user operation behaviors can be analyzed to more accurately determine whether the user's operation behavior is abnormal when abnormal behavior is detected. The aforementioned system resource usage time-series data can be understood as system operating indicators, such as CPU utilization and memory usage. The aforementioned network traffic can be understood as the amount of data transmitted in the network; network traffic data is a key indicator for measuring network usage and load.

[0101] The aforementioned desensitization can be understood as a process of desensitizing the complete multimodal context data of abnormal behavior to protect privacy and prevent leakage. Specifically, the core of desensitization is to replace real information with fictitious data to ensure that sensitive information is not exposed during data use.

[0102] The encryption process described above can be understood as converting the complete multimodal context data of the desensitized abnormal behavior into ciphertext, which can only be recovered by authorized users through decryption.

[0103] In one possible implementation, for example, after logging into the system, a cloud PC user suddenly engages in a large number of illegal download operations. The abnormal behavior detection module of the cloud PC system detects this abnormal behavior and records complete multimodal context data related to the abnormal behavior, such as user operation behavior sequences, system resource usage time-series data, and network traffic data. After desensitizing and encrypting the multimodal context data, it is sent back to the cloud PC management platform. On the platform, the desensitized and encrypted multimodal context data is used to train and optimize the abnormal behavior detection model to improve the detection accuracy of similar abnormal behaviors in the future.

[0104] Optionally, in the step of generating a graded response strategy based on the anomaly type, the mapping relationship between anomaly type and risk level can be predefined, as well as the response operations corresponding to each level of risk; the risk level is determined by querying the mapping table based on the anomaly type identifier; if it is low risk, a log operation is generated; if it is medium risk, a real-time alarm is triggered and behavior monitoring is started; if it is high risk, the session is interrupted, behavior is blocked, or a manual review process is started; after the response operation is executed, a handling report is generated and sent to the administrator.

[0105] In this embodiment of the invention, the mapping relationship between the above-mentioned anomaly types and risk levels is a predefined mapping relationship between anomaly types and risk levels by the system. Different anomaly types correspond to different risk levels, and different risk levels correspond to different response operations.

[0106] Specifically, the risk level of an anomaly can be determined by querying the mapping relationship between anomaly types and risk levels. Different response actions will be taken for different risk levels. If the risk level of the anomaly is low, a log operation will be generated. If the risk level of the anomaly is medium, a real-time alarm will be triggered and behavior monitoring will be started. If the risk level of the anomaly is high, the session will be interrupted, the behavior will be blocked, or a manual review process will be initiated. After the response action is executed, a handling report will be generated and sent to the administrator.

[0107] Optionally, in the step of real-time acquisition of multimodal data streams, a lightweight acquisition agent deployed in a cloud computer instance can be used to synchronously capture user operation behavior sequences, system resource usage time-series data, and network traffic data at a preset sampling frequency. After lossless compression and AES encryption of the user operation behavior sequences, system resource usage time-series data, and network traffic data, the acquisition agent transmits them to the detection engine through a dedicated data channel.

[0108] In this embodiment of the invention, the aforementioned lightweight acquisition agent can be understood as an agent program that acquires multimodal data streams with low resource consumption.

[0109] The aforementioned preset sampling frequency is a sampling frequency pre-set by the system.

[0110] The above sequence of user actions can be understood as a record of user actions on the cloud computer, such as opening files, running programs, and browsing web pages.

[0111] The above system resource usage time-series data can be understood as the system resource utilization recorded in chronological order, such as the utilization rate of resources like CPU and memory.

[0112] The network traffic data mentioned above can be understood as the amount of data transmitted in the network. Network traffic data is a key indicator for measuring network usage and load.

[0113] The aforementioned lossless compression can be understood as a process that compresses user operation behavior sequences, system resource usage time series data, and network traffic data by utilizing the statistical redundancy of the data, and the decompressed data is exactly the same as the user operation behavior sequences, system resource usage time series data, and network traffic data.

[0114] The AES encryption described above is a symmetric encryption technology that uses a 128-bit block length and supports key lengths of 128, 192, and 256 bits. Encryption is achieved through four core operations: byte substitution, row shifting, column obfuscation, and round key addition. AES encryption splits the plaintext into 128-bit blocks, and each block is encrypted independently.

[0115] The aforementioned dedicated data channel is an independent data transmission path established for multimodal data streams.

[0116] The aforementioned detection engine is used to analyze and detect abnormal behaviors and anomaly types in multimodal data streams.

[0117] It should be noted that a lightweight data acquisition agent can be deployed in a cloud PC instance to synchronously capture user operation behavior sequences, system resource usage time-series data, and network traffic data at a preset sampling frequency. The acquisition agent performs lossless compression and AES encryption on this data before transmitting it to the detection engine via a dedicated data channel. This invention can monitor and analyze user operation behavior, system performance, and network traffic to identify potential problems or anomalies. For example, if an application A is detected to suddenly consume a large amount of system resources, it indicates that application A is malfunctioning.

[0118] like Figure 2 As shown, this embodiment of the invention provides a device for detecting abnormal behavior of a cloud computer. The device includes:

[0119] The acquisition module 201 is used to acquire multimodal data streams during the operation of the cloud computer in real time. The multimodal data streams include user operation behavior sequences, system resource usage time-series data, and network traffic data.

[0120] The generation module 202 is used to perform real-time feature extraction and cross-modal fusion on the multimodal data stream to generate a fused multi-dimensional behavioral feature vector.

[0121] The training module 203 is used to input the multi-dimensional behavioral feature vector into the abnormal behavior detection model trained by multi-scenario federated learning. The abnormal behavior detection model adaptively adjusts the discrimination threshold according to the current application scenario and outputs the abnormal discrimination result and the abnormal type identifier.

[0122] The processing module 204 is used to generate a hierarchical response strategy based on the abnormality type and execute corresponding operations when the behavior is identified as abnormal.

[0123] Optionally, the generation module 202 is further configured to extract spatiotemporal features from user operation behavior sequences, semantic features from system resource usage time series data, and fluctuation pattern features from network traffic data through parallel processing channels. The spatiotemporal features are extracted using a 3D convolutional neural network, the semantic features are extracted using a bidirectional long short-term memory network, and the fluctuation pattern features are extracted using a one-dimensional convolutional neural network with a self-attention mechanism. The above features are aligned and weighted by a fusion module based on an attention mechanism. The fusion module calculates the attention weights of each feature modality and performs a weighted summation based on the weights to generate a multi-dimensional behavioral feature vector with scene awareness.

[0124] Optionally, the training module 203 is further configured to calculate the dynamic anomaly coefficient of abnormal behavior based on historical behavior data of each application scenario. This coefficient is obtained by weighted fusion of behavior frequency, resource usage deviation, and associated security event level, wherein the weights are preset according to scenario type and empirical knowledge. The nature of the anomaly is determined based on the dynamic anomaly coefficient and scenario context, and a multi-scenario, multi-modal training sample set is constructed, which includes positive samples, negative samples, and difficult sample samples. The initial multimodal model is distributed and trained on each cloud computer node using a federated learning framework. Each node uses local data to train the model and uploads the model parameters to the central server. The central server uses the FedAvg algorithm to aggregate the parameters of each node and update the global model. An incremental learning mechanism is introduced during the model training process, and the model is fine-tuned periodically using new scenario data to adapt to distribution changes.

[0125] Optionally, the training module 203 is also used to acquire scene metadata in real time, including scene critical level, real-time risk status and user identity permissions; input the scene metadata into a pre-configured threshold adjustment rule engine, the rule engine outputs the discrimination threshold adjustment amount for the current scene; and dynamically adjust the sensitivity and threshold of anomaly discrimination according to the adjustment amount, wherein high-risk scenes correspond to lower thresholds to improve detection sensitivity.

[0126] Optionally, the device is also used to record the complete multimodal context data of the abnormal behavior after detecting the abnormal behavior, including the user operation behavior sequence, system resource usage time series data and network traffic data within a preset time window before the abnormality; to perform desensitization and encryption processing on the recorded context data, and to send it back to the cloud computer management platform for model iteration optimization and anomaly analysis.

[0127] Optionally, the processing module 204 is also used to predefine the mapping relationship between anomaly types and risk levels, and the response operations corresponding to each level of risk; to query the mapping table according to the anomaly type identifier to determine the risk level; if it is low risk, a log operation is generated; if it is medium risk, a real-time alarm is triggered and behavior monitoring is started; if it is high risk, the session is interrupted, behavior is blocked, or a manual review process is started; after the response operation is executed, a handling report is generated and sent to the administrator.

[0128] Optionally, the acquisition module 201 is further configured to synchronously capture user operation behavior sequences, system resource usage time series data, and network traffic data at a preset sampling frequency through a lightweight acquisition agent deployed in a cloud computer instance; after lossless compression and AES encryption of the user operation behavior sequences, system resource usage time series data, and network traffic data, the acquisition agent transmits them to the detection engine through a dedicated data channel.

[0129] like Figure 3 As shown, this embodiment of the invention also provides an electronic device, including a processor, which can execute any of the above-described methods for detecting abnormal behavior of cloud computers.

[0130] Specifically, it includes a processor 301 and a memory 302, as well as a computer program stored in the memory 302 and capable of running on the processor 301, which executes a method for detecting abnormal behavior of the cloud computer, wherein:

[0131] The processor 301 executes the calculator program for detecting abnormal behavior of the cloud computer stored in the memory 302, and performs the following steps:

[0132] The system collects multimodal data streams during the operation of the cloud computer in real time. These multimodal data streams include user operation behavior sequences, system resource usage time-series data, and network traffic data.

[0133] Real-time feature extraction and cross-modal fusion are performed on the multimodal data stream to generate a fused multidimensional behavioral feature vector;

[0134] The multi-dimensional behavioral feature vector is input into the abnormal behavior detection model trained by multi-scenario federated learning. The abnormal behavior detection model adaptively adjusts the discrimination threshold according to the current application scenario and outputs the abnormal discrimination result and the abnormal type identifier.

[0135] When an abnormal behavior is identified, a tiered response strategy is generated based on the abnormality type and corresponding operations are executed.

[0136] Optionally, the real-time feature extraction and cross-modal fusion of the multimodal data stream performed by processor 301 to generate a fused multi-dimensional behavioral feature vector includes:

[0137] The spatiotemporal features of user operation behavior sequences, the semantic features of system resource usage time series data, and the fluctuation pattern features of network traffic data are extracted through parallel processing channels. The spatiotemporal features are extracted using a 3D convolutional neural network, the semantic features are extracted using a bidirectional long short-term memory network, and the fluctuation pattern features are extracted using a one-dimensional convolutional neural network with a self-attention mechanism.

[0138] The above features are aligned and weighted by an attention-based fusion module. The fusion module calculates the attention weights of each feature modality and performs a weighted summation based on the weights to generate a multi-dimensional behavioral feature vector with scene awareness.

[0139] Optionally, the training of the abnormal behavior detection model executed by processor 301 includes:

[0140] Based on historical behavior data from various application scenarios, a dynamic anomaly coefficient for abnormal behavior is calculated. This coefficient is obtained by weighted fusion of behavior frequency, resource usage deviation, and associated security event level, with the weights preset according to scenario type and empirical knowledge.

[0141] The nature of the anomaly is determined based on the dynamic anomaly coefficient and the scene context, and a multi-scene, multi-modal training sample set is constructed, which includes positive samples, negative samples and hard sample samples.

[0142] The initial multimodal model is trained in a distributed manner on each cloud computer node using a federated learning framework. Each node trains the model using local data and uploads the model parameters to the central server. The central server uses the FedAvg algorithm to aggregate the parameters of each node and update the global model. An incremental learning mechanism is introduced during the model training process to fine-tune the model periodically using new scenario data to adapt to changes in distribution.

[0143] Optionally, the model executed by processor 301 adaptively adjusts the discrimination threshold according to the current application scenario, including:

[0144] Real-time acquisition of scene metadata, including scene criticality level, real-time risk status, and user identity and permissions;

[0145] The scene metadata is input into a pre-configured threshold adjustment rule engine, and the rule engine outputs the threshold adjustment amount for the current scene;

[0146] The sensitivity and threshold for anomaly detection are dynamically adjusted based on the adjustment amount, with lower thresholds for high-risk scenarios to improve detection sensitivity.

[0147] Optionally, the method executed by processor 301 further includes:

[0148] After detecting abnormal behavior, record the complete multimodal context data of the abnormal behavior, including the sequence of user operation behavior within the preset time window before the abnormality, system resource usage time series data, and network traffic data;

[0149] The recorded context data is anonymized and encrypted, and then sent back to the cloud computer management platform for model iteration optimization and anomaly analysis.

[0150] Optionally, the generation of a graded response strategy based on the exception type executed by processor 301 includes:

[0151] Predefined mapping relationships between anomaly types and risk levels, and corresponding response operations for each risk level;

[0152] The risk level is determined by querying the mapping table based on the anomaly type identifier. If it is low risk, a log operation is generated. If it is medium risk, a real-time alarm is triggered and behavior monitoring is started. If it is high risk, the session is interrupted, the behavior is blocked, or a manual review process is started.

[0153] After the response action is executed, a handling report is generated and sent to the administrator.

[0154] Optionally, the real-time acquisition of multimodal data stream executed by processor 301 includes:

[0155] By deploying a lightweight data acquisition agent within a cloud PC instance, user operation behavior sequences, system resource usage time-series data, and network traffic data are synchronously captured at a preset sampling frequency.

[0156] The data acquisition agent performs lossless compression and AES encryption on user operation behavior sequences, system resource usage time-series data, and network traffic data, and then transmits them to the detection engine through a dedicated data channel.

[0157] This invention also provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the various processes of the cloud computer abnormal behavior detection method provided in this invention and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0158] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0159] The above description discloses only preferred embodiments of the present invention and should not be construed as limiting the scope of the present invention. Therefore, equivalent variations made in accordance with the claims of the present invention are still within the scope of the present invention.

Claims

1. A method for detecting abnormal behavior of a cloud computer, characterized in that, include: The system collects multimodal data streams during the operation of the cloud computer in real time. These multimodal data streams include user operation behavior sequences, system resource usage time-series data, and network traffic data. Real-time feature extraction and cross-modal fusion are performed on the multimodal data stream to generate a fused multidimensional behavioral feature vector; The multi-dimensional behavioral feature vector is input into the abnormal behavior detection model trained by multi-scenario federated learning. The abnormal behavior detection model adaptively adjusts the discrimination threshold according to the current application scenario and outputs the abnormal discrimination result and the abnormal type identifier. When an abnormal behavior is identified, a tiered response strategy is generated based on the abnormality type and corresponding operations are executed.

2. The method according to claim 1, characterized in that, The real-time feature extraction and cross-modal fusion of multimodal data streams to generate a fused multidimensional behavioral feature vector includes: The spatiotemporal features of user operation behavior sequences, the semantic features of system resource usage time series data, and the fluctuation pattern features of network traffic data are extracted through parallel processing channels. The spatiotemporal features are extracted using a 3D convolutional neural network, the semantic features are extracted using a bidirectional long short-term memory network, and the fluctuation pattern features are extracted using a one-dimensional convolutional neural network with a self-attention mechanism. The above features are aligned and weighted by an attention-based fusion module. The fusion module calculates the attention weights of each feature modality and performs a weighted summation based on the weights to generate a multi-dimensional behavioral feature vector with scene awareness.

3. The method according to claim 1, characterized in that, The training of the abnormal behavior detection model includes: Based on historical behavior data from various application scenarios, a dynamic anomaly coefficient for abnormal behavior is calculated. This coefficient is obtained by weighted fusion of behavior frequency, resource usage deviation, and associated security event level, with the weights preset according to scenario type and empirical knowledge. The nature of the anomaly is determined based on the dynamic anomaly coefficient and the scene context, and a multi-scene, multi-modal training sample set is constructed, which includes positive samples, negative samples and hard sample samples. The initial multimodal model is trained in a distributed manner on each cloud computer node using a federated learning framework. Each node trains the model using local data and uploads the model parameters to the central server. The central server uses the FedAvg algorithm to aggregate the parameters of each node and update the global model. An incremental learning mechanism is introduced during the model training process to fine-tune the model periodically using new scenario data to adapt to changes in distribution.

4. The method according to claim 1, characterized in that, The model adaptively adjusts the discrimination threshold according to the current application scenario, including: Real-time acquisition of scene metadata, including scene criticality level, real-time risk status, and user identity and permissions; The scene metadata is input into a pre-configured threshold adjustment rule engine, and the rule engine outputs the threshold adjustment amount for the current scene; The sensitivity and threshold for anomaly detection are dynamically adjusted based on the adjustment amount, with lower thresholds for high-risk scenarios to improve detection sensitivity.

5. The method according to claim 1, characterized in that, The method further includes: After detecting abnormal behavior, record the complete multimodal context data of the abnormal behavior, including the sequence of user operation behavior within the preset time window before the abnormality, system resource usage time series data, and network traffic data; The recorded context data is anonymized and encrypted, and then sent back to the cloud computer management platform for model iteration optimization and anomaly analysis.

6. The method according to claim 1, characterized in that, The strategy for generating tiered responses based on anomaly type includes: Predefined mapping relationships between anomaly types and risk levels, and corresponding response operations for each risk level; The risk level is determined by querying the mapping table based on the anomaly type identifier. If it is low risk, a log operation is generated. If it is medium risk, a real-time alarm is triggered and behavior monitoring is started. If it is high risk, the session is interrupted, the behavior is blocked, or a manual review process is started. After the response action is executed, a handling report is generated and sent to the administrator.

7. The method according to claim 1, characterized in that, The real-time acquisition of multimodal data streams includes: By deploying a lightweight data acquisition agent within a cloud PC instance, user operation behavior sequences, system resource usage time-series data, and network traffic data are synchronously captured at a preset sampling frequency. The data acquisition agent performs lossless compression and AES encryption on user operation behavior sequences, system resource usage time-series data, and network traffic data, and then transmits them to the detection engine through a dedicated data channel.

8. A device for detecting abnormal behavior of a cloud computer, characterized in that, The display device for the cloud computer interface includes: The acquisition module is used to acquire multimodal data streams in real time during the operation of the cloud computer. The multimodal data streams include user operation behavior sequences, system resource usage time-series data, and network traffic data. The generation module is used to perform real-time feature extraction and cross-modal fusion on the multimodal data stream to generate a fused multi-dimensional behavioral feature vector. The training module is used to input the multi-dimensional behavioral feature vector into the abnormal behavior detection model trained by multi-scenario federated learning. The abnormal behavior detection model adaptively adjusts the discrimination threshold according to the current application scenario and outputs the abnormal discrimination result and the abnormal type identifier. The processing module is used to generate a hierarchical response strategy based on the anomaly type and execute corresponding operations when an abnormal behavior is identified.

9. An electronic device, characterized in that, include: The memory, the processor, and the computer program stored on the memory and executable on the processor, wherein the processor executes the computer program to implement the steps in the method for detecting abnormal behavior of a cloud computer as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps in the method for detecting abnormal behavior of a cloud computer as described in any one of claims 1 to 7.

Images