A zero-trust secure dynamic configuration method and system for edge AI computing servers

Abstract

This application provides a zero-trust security dynamic configuration method and system for edge AI computing servers, relating to the field of edge computing security technology. This application acquires behavioral data from the server's operating system, divides it into sliding time windows, calculates the distribution density and transition probability of event types in each window, and constructs a behavioral feature vector. This vector is then mapped to a time-series graph, where nodes correspond to system entities and edges correspond to interaction relationships. Dynamic weights are assigned to edges based on real-time security policies and interaction strength. Based on these weights, the dynamic interactions of entities are continuously monitored and analyzed to obtain a continuous-time behavioral representation of the system. The difference between this representation and a baseline behavioral pattern is evaluated to generate a dynamic trust index. When the index exceeds a preset range, a zero-trust decision mechanism is triggered. Through multi-objective optimization, the dynamic configuration of server resource access permissions and computing task allocation strategies is achieved, ensuring server security.

Description

Technical Field

[0001] This application relates to the field of edge computing security technology, and in particular to a zero-trust security dynamic configuration method and system for edge AI computing power servers. Background Technology

[0002] In collaborative computing scenarios involving IoT terminals and edge AI computing servers, the number and types of terminal devices are vast, and servers need to process massive amounts of heterogeneous data and allocate computing resources in real time. Simultaneously, they face inherent security threats such as unauthorized resource access and abnormal process calls. This requires servers to possess the ability to dynamically perceive abnormal behavior, assess the trust status of interactions between terminals and servers in real time, and dynamically adjust security strategies based on risks. This ensures both collaborative computing efficiency and the ability to defend against complex security attacks, guaranteeing controllability of data and computing resources.

[0003] Currently, the mainstream solution for this scenario is an anomaly detection and fixed permission control mechanism based on a static rule base. This solution performs matching detection on server behavior by pre-setting known attack characteristics and permission access rules. When behavior that matches the anomaly characteristics in the rule base is detected, a fixed security response is triggered, thereby achieving basic security protection.

[0004] However, this solution has significant limitations: First, the static rule base relies on manual pre-setting, which makes it difficult to cover new abnormal behaviors that constantly emerge in the scenario, and it is easy to miss detections; second, fixed permission control lacks dynamic adaptability and cannot adjust trust assessment and permission policies according to real-time interaction intensity and behavior risk level, which may lead to over-protection affecting efficiency or under-protection causing vulnerabilities; third, it does not consider the temporal correlation of behaviors and judges anomalies only by matching single events, making it difficult to identify hidden and continuous abnormal behaviors. Summary of the Invention

[0005] The purpose of this application is to provide a zero-trust security dynamic configuration method and system for edge AI computing power servers, so as to solve the problems of high false negative rate, efficiency and security imbalance, and difficulty in identifying hidden anomalies in the existing technology.

[0006] To address the aforementioned technical problems, in a first aspect, this application provides a zero-trust security dynamic configuration method for edge AI computing power servers, comprising:

[0007] Acquire behavioral data generated by the operating system of the edge AI computing server;

[0008] The behavioral data is divided according to a sliding time window, and the distribution density of event types and the transition probability between events are calculated within each window segment to construct a behavioral feature vector.

[0009] The behavioral feature vector is mapped to a time sequence graph, where nodes correspond to system entities and edges correspond to entity interaction relationships. Dynamic weight values ​​are assigned to the edges of the time sequence graph according to real-time security policies and interaction strength.

[0010] Based on the dynamic weight values, the dynamic interaction behavior between entities in the time series diagram is continuously monitored and analyzed to obtain the behavior representation of the system in continuous time.

[0011] Based on the behavioral representation and the behavior pattern of the benchmark device, the difference is evaluated to obtain the degree of deviation between the current system and the normal system, and a dynamic trust index is generated based on the degree of deviation.

[0012] When the dynamic trust index exceeds the preset range, the zero trust policy decision mechanism is triggered, and the resource access permissions and computing task allocation strategy of the dynamic configuration server are optimized through multi-objective optimization.

[0013] Optionally, when the dynamic trust index exceeds a preset range, a zero-trust policy decision mechanism is triggered to optimize the resource access permissions and computing task allocation strategy of the dynamic configuration server through multi-objective optimization, including:

[0014] When the dynamic trust index exceeds the preset range, the zero-trust strategy decision-making mechanism is activated to establish a composite optimization objective that includes resource isolation requirements and computing performance requirements.

[0015] Based on the degree of deviation of the dynamic trust index, the constraint level of resource access permissions and the security level of computing task allocation are determined to construct a multi-dimensional constraint set containing permission constraints and task allocation conditions.

[0016] Under the premise of satisfying the multi-dimensional constraint set, the composite optimization objective is processed synchronously using a collaborative optimization method, and resource access permission configuration scheme and computing task allocation scheme are generated in parallel.

[0017] The resource access permission configuration scheme is converted into specific access control rules, and the computing task allocation scheme is converted into a task scheduling strategy;

[0018] The access control rules and task scheduling policies are integrated into a unified security policy set, and the security policy set is distributed to the policy execution module of the server.

[0019] Optionally, based on the degree of deviation of the dynamic trust index, the constraint level of resource access permissions and the security level of computation task allocation are determined to construct a multi-dimensional constraint set containing permission constraints and task allocation conditions, including:

[0020] The numerical range of the dynamic trust index is divided into multiple consecutive trust intervals, and each trust interval corresponds to a preset basic constraint level and a basic security level.

[0021] Based on the deviation distance of the dynamic trust index from the boundary of the trust interval, calculate the constraint level adjustment amount and the security level adjustment amount;

[0022] The constraint level is obtained by superimposing the basic constraint level and the constraint level adjustment amount; the safety level is obtained by superimposing the basic safety level and the safety level adjustment amount.

[0023] Based on the constraint level, matching permission constraints are selected from a predefined permission template library. The permission constraints include a set of resource types that the system entity can access and a set of operation types that are allowed to be executed.

[0024] Based on the security level, a matching task allocation condition is selected from a predefined task template library. The task allocation condition includes the range of resource quotas and execution priority range that can be allocated to the task.

[0025] The permission constraints and task allocation conditions are combined to form a multi-dimensional constraint set.

[0026] Optionally, under the premise of satisfying the multi-dimensional constraint set, a collaborative optimization method is used to simultaneously process the composite optimization objective, and to generate resource access permission configuration schemes and computation task allocation schemes in parallel, including:

[0027] Based on the resource isolation requirements in the composite optimization objective and the permission constraints in the multi-dimensional constraint set, the correspondence between system entities and resource access permissions is iteratively adjusted to generate a resource access permission configuration scheme.

[0028] Based on the computational efficiency requirements in the composite optimization objective and the task allocation conditions in the multi-dimensional constraint set, a computational task allocation scheme is generated by iteratively adjusting the allocation relationship between computational tasks and resource quotas.

[0029] The resource access permission configuration scheme and the computing task allocation scheme are coupled and verified to ensure that there is no conflict between the two schemes in resource allocation. When the coupling verification is successful, the resource access permission configuration scheme and the computing task allocation scheme are output.

[0030] Optionally, the dynamic interaction behavior between entities in the time sequence diagram is continuously monitored and analyzed to obtain a behavioral representation of the system over continuous time, including:

[0031] Within each sliding time window, extract the entity pairs connected by each edge in the time sequence graph and the corresponding dynamic weight values ​​as the entity interaction features of the current window.

[0032] For each system entity, aggregate the dynamic weight values ​​of all associated edges within the current time window to calculate the entity's comprehensive activity index;

[0033] The stability index of the interaction relationship between entities is calculated based on the dynamic weight changes of the same entity pair between adjacent time windows.

[0034] The entity interaction features, the comprehensive activity index, and the stability index are combined in chronological order to form a behavioral representation of the system over continuous time.

[0035] Optionally, a difference assessment is performed based on the behavioral representation and the behavior pattern of a benchmark device to obtain the degree of deviation between the current system and the normal system, and a dynamic trust index is generated based on the degree of deviation, including:

[0036] By acquiring historical behavior representations of a benchmark device under normal operating conditions, a benchmark behavior pattern is established. The behavior representations of the current system are then compared item by item with the benchmark behavior pattern, and the difference values ​​of each feature are calculated.

[0037] Based on the degree of influence of different features on the system's security status, corresponding weight coefficients are assigned to the difference values ​​of each feature. Based on the weight coefficients, a weighted calculation is performed on the difference values ​​of all features to obtain the degree of deviation between the current system and the normal system.

[0038] The degree of deviation is converted into a standardized dynamic trust index through a preset mapping relationship.

[0039] Optionally, the behavioral feature vector is mapped to a time series graph, where nodes correspond to system entities and edges correspond to entity interaction relationships. Dynamic weight values ​​are assigned to the edges of the time series graph based on real-time security policies and interaction strength, including:

[0040] The system entities involved in the behavioral feature vector are identified as nodes, and based on the event sequence recorded in the behavioral feature vector, connection edges are established between entity nodes with interactive relationships to construct a time sequence graph.

[0041] The initial interaction strength of each edge is calculated based on the frequency, duration, and resource consumption level of the interaction behavior between entities.

[0042] According to the rules defined in the real-time security policy, the initial interaction intensity is adjusted to obtain the corresponding dynamic weight value, and the dynamic weight value is assigned to the corresponding edge in the time sequence graph.

[0043] Optionally, the behavioral data is divided according to a sliding time window, and the distribution density of event types and the transition probability between events within each window segment are calculated to construct a behavioral feature vector, including:

[0044] The behavioral data is divided into consecutive window segments according to time sequence. The occurrence frequency of various system events is counted within each window segment to calculate the distribution density of each event type within the window segment.

[0045] By analyzing the correlation between adjacent system events within a window segment, the transition probability between event types within the window segment is calculated;

[0046] The distribution density and the transition probability are combined in a preset order to form the behavioral feature vector corresponding to the window segment.

[0047] Optionally, based on the dynamic weight changes of the same entity pair between adjacent time windows, a stability index for the interaction relationship between entities is calculated, including:

[0048] Obtain the dynamic weight values ​​corresponding to the same entity pair in the current time window and the previous adjacent time window, and calculate the change between the dynamic weight value of the current time window and the dynamic weight value of the previous adjacent time window.

[0049] Based on the absolute value of the change and combined with the preset change threshold, the interaction stability score of the entity pair between adjacent time windows is determined. The interaction stability scores of all entity pairs are aggregated to calculate the overall interaction relationship stability index of the system.

[0050] Secondly, this application provides a zero-trust security dynamic configuration system for edge AI computing power servers, including:

[0051] The acquisition module is used to acquire behavioral data generated by the operating system of the edge AI computing server.

[0052] The calculation module is used to divide the behavioral data according to the sliding time window and calculate the distribution density of event types and the transition probability between events within each window segment in order to construct a behavioral feature vector.

[0053] The mapping module is used to map the behavior feature vector into a time sequence graph, where nodes correspond to system entities and edges correspond to entity interaction relationships, and dynamic weight values ​​are assigned to the edges of the time sequence graph according to real-time security policies and interaction strength.

[0054] The monitoring module is used to continuously monitor and analyze the dynamic interaction behavior between entities in the time series diagram based on the dynamic weight value, so as to obtain the behavior representation of the system in continuous time.

[0055] The generation module is used to evaluate the difference between the behavior representation and the behavior pattern of the benchmark device, obtain the degree of deviation between the current system and the normal system, and generate a dynamic trust index based on the degree of deviation.

[0056] The decision module is used to trigger a zero-trust policy decision mechanism when the dynamic trust index exceeds a preset range, and to optimize the resource access permissions and computing task allocation strategy of the dynamic configuration server through multi-objective optimization.

[0057] Thirdly, this application provides an electronic device, comprising:

[0058] Memory, used to store computer programs;

[0059] A processor, used to execute the computer program, implements the steps of the zero-trust security dynamic configuration method for edge AI computing power servers as described in the first aspect above.

[0060] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, can implement the steps of the zero-trust security dynamic configuration method for edge AI computing power servers as described in the first aspect above.

[0061] The zero-trust security dynamic configuration method for edge AI computing servers provided in this application acquires behavioral data generated by the operating system of the edge AI computing server, providing fundamental data support for subsequent abnormal behavior analysis and security assessment, ensuring that the data source is directly related to the core operating status of the server; by dividing the behavioral data into sliding time windows and calculating the event type distribution density and transition probability between events within the window to construct behavioral feature vectors, dynamic behavioral data can be transformed into structured features, accurately capturing behavioral patterns and trends in different time periods; by mapping the behavioral feature vectors to a time series graph and assigning dynamic weight values ​​to the edges, the interaction relationships between system entities can be intuitively presented, and the weights reflect the interaction... By assessing the security risks and importance of interactions, the system enhances the targeting of behavioral analysis. Through continuous monitoring and analysis of entity interaction behavior based on dynamic weight values, a continuous-time behavioral representation of the system is obtained, enabling real-time tracking of server behavior and fully reflecting the dynamic changes in the system's operating status. By evaluating the difference between the behavioral representation and the baseline pattern, a dynamic trust index is generated, quantifying the degree of deviation of the current system from its normal state and providing a clear basis for risk assessment in security decisions. When the dynamic trust index exceeds a preset range, a zero-trust decision mechanism is triggered, and resource access permissions and computing task allocation strategies are dynamically configured, enabling timely response to security risks and flexibly adapting to computing power allocation needs while ensuring server security.

[0062] Furthermore, by establishing a composite optimization objective and a multi-dimensional constraint set, it is possible to ensure server security isolation while also taking into account computing performance, avoiding excessive security or inefficiency caused by a single objective; by generating configuration and allocation schemes in parallel through collaborative optimization methods, it is possible to improve the efficiency of policy formulation and ensure the timeliness of security response; by converting the schemes into executable rules and policies and integrating and distributing them, it is possible to achieve the standardized implementation of security policies, ensure the effective execution of the zero-trust decision-making mechanism, and further strengthen the security management capabilities and resource scheduling flexibility of edge AI computing servers in abnormal states. Attached Figure Description

[0063] To more clearly illustrate the technical solutions of the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0064] Figure 1 A flowchart illustrating a zero-trust security dynamic configuration method for an edge AI computing server provided in this application embodiment;

[0065] Figure 2 A flowchart illustrating the specific implementation of a zero-trust security dynamic configuration method for an edge AI computing server provided in this application embodiment;

[0066] Figure 3 A scenario diagram illustrating a zero-trust security dynamic configuration method for an edge AI computing server provided in this application embodiment;

[0067] Figure 4 This is a schematic diagram of the structure of a zero-trust security dynamic configuration system for an edge AI computing server provided in an embodiment of this application. Detailed Implementation

[0068] In collaborative computing scenarios involving IoT terminals and edge AI computing servers, existing security solutions based on static rule bases struggle to address core issues in real-world applications. On one hand, manually preset rules cannot cover constantly emerging new abnormal behaviors, making it easy for security threats to slip through the cracks. On the other hand, fixed and unchanging access control methods either slow down computing efficiency due to over-protection or leave security vulnerabilities due to insufficient protection. Furthermore, this solution only considers individual behaviors and neglects the relationships between them, failing to identify hidden and continuously occurring anomalies. These problems make it difficult for servers to balance security and efficiency, failing to meet the security requirements of dynamic collaborative scenarios.

[0069] To address the aforementioned issues, this application proposes a zero-trust security dynamic configuration method for edge AI computing servers. This method first acquires behavioral data of the server's operation, constructs features by analyzing behavioral patterns across different time periods, then transforms these features into an intuitive interaction graph and labels them with risk weights. Subsequently, it compares the real-time trust level with normal behavior patterns, dynamically adjusting resource permissions and task allocation if the trust level becomes abnormal. This approach does not rely on fixed rules and can flexibly identify new anomalies; it can adjust strategies based on real-time risks, balancing security and efficiency; and by analyzing behavioral correlations, it can also discover hidden threats, fundamentally solving the problems of missed detections, rigid strategies, and difficulty in identifying hidden anomalies in existing solutions, providing a more reliable guarantee for the secure operation of edge AI computing servers.

[0070] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are merely some embodiments of the present application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0071] The core of this application is to provide a zero-trust security dynamic configuration method for edge AI computing power servers, and a flowchart of one specific implementation is shown below. Figure 1 As shown, the method includes:

[0072] S101. Obtain behavioral data generated by the operating system of the edge AI computing server.

[0073] The behavioral data includes three core types of information: first, process and program operation data, such as the name of the running process, start and end time, system resource call status, and abnormal process creation records; second, resource access interaction data, such as the terminal's access path, time, operation type, network port connection status, and permission request records for server files or databases; and third, system configuration and status data, such as operating system parameter modification records, hardware computing load changes, and error warning information in system logs.

[0074] The acquisition method adopts a low-intrusion design. On the one hand, it relies on the operating system's native tools (such as Linux's top and ps commands) and open interfaces to extract native data and read system logs. On the other hand, it deploys a lightweight acquisition agent to monitor key behaviors in real time and initially convert unstructured data into structured data, ensuring that the acquisition process does not affect the server's normal computing power allocation.

[0075] S102. Divide the behavioral data according to the sliding time window, and calculate the distribution density of event types and the transition probability between events within each window segment to construct a behavioral feature vector.

[0076] Optionally, step S102 may specifically include the following steps:

[0077] S1021. Divide the behavioral data into continuous window segments according to the time sequence, and count the occurrence frequency of various system events in each window segment to calculate the distribution density of each event type in the window segment.

[0078] S1022. By analyzing the correlation between adjacent system events within a window segment, calculate the transition probability between event types within the window segment;

[0079] S1023. The distribution density and the transition probability are combined in a preset order to form a behavioral feature vector corresponding to the window segment.

[0080] In the above steps, a sliding time window refers to continuous and overlapping time segments divided according to a fixed time length or a fixed data volume. Its function is to cut time-series behavioral data into units that are easy to analyze. Event type refers to the operation category with the same characteristics in the behavioral data, such as "process start", "file read", "port connection", etc. Distribution density refers to the frequency of occurrence of a certain event type in a single window segment, which is used to reflect the activity level of the event in a specific time period. Transition probability refers to the probability that another event type will appear immediately after the previous event type occurs in a single window segment, which is used to reflect the correlation between events. Behavioral feature vector refers to a one-dimensional array formed by arranging the distribution density and transition probability of all event types in a single window segment in a preset order. Its purpose is to transform unstructured behavioral data into computable structured data.

[0081] In this embodiment, firstly, in step S1021, the behavioral data is divided into continuous window segments according to the time sequence of its generation, using a preset sliding time window. The duration and overlap rate of the sliding time window can be set according to actual needs, for example, the window duration is set to 5 minutes and the window overlap rate is set to 50%. Within each window segment, the occurrence frequency of various system events such as "process start," "file read," and "port connection" is counted. Then, the distribution density of that event type within the window segment is obtained by dividing the occurrence frequency of a certain type of event by the total number of all events within that window segment. For example, in a 5-minute window segment, a total of 100 behavioral data points are generated, with the "file read" event occurring 25 times and the "process start" event occurring 15 times. The distribution density of the "file read" event is 25 divided by 100, resulting in 0.25; the distribution density of the "process start" event is 15 divided by 100, resulting in 0.15.

[0082] Secondly, in step S1022, within each divided window segment, all system event sequences arranged in chronological order are extracted, and the type association between adjacent events is analyzed. The number of times a subsequent event type (e.g., "process start") occurs after a previous event type (e.g., "file read") occurs is counted. This number is then divided by the total number of occurrences of the previous event type within the window segment to obtain the transition probability between the two event types. For example, in the same 5-minute window segment, the "process start" event occurs 15 times. Ten of these "process start" events are immediately followed by a "file read" event. Therefore, the transition probability from "process start" to "file read" is 10 divided by 15, resulting in approximately 0.67. If three "process start" events are immediately followed by a "port connection" event, the transition probability from "process start" to "port connection" is 3 divided by 15, resulting in 0.2.

[0083] Next, in step S1023, a sorting rule for event types is pre-defined. This rule can be selected by alphabetical order of event names or by the degree of impact on system security. The distribution densities of all event types obtained in step S1021 are then arranged according to this rule. Simultaneously, a sorting rule for event transition relationships is pre-defined. This rule can be selected by sorting by the previous event type, and then by the next event type within the same previous event type. The transition probabilities between all events obtained in step S1022 are then arranged according to this rule. Finally, the arranged distribution densities and transition probabilities are concatenated into a one-dimensional array, which represents the behavioral feature vector of the corresponding window segment. For example, arranging the distribution density in the order of "process start", "file read", and "port connection" yields the array [0.15, 0.25, 0.1]; arranging the transition probabilities in the order of "process start to file read", "process start to port connection", and "file read to port connection" yields the array [0.67, 0.2, 0.3]; and concatenating the two arrays results in the behavioral feature vector [0.15, 0.25, 0.1, 0.67, 0.2, 0.3].

[0084] In practical applications, during the collaborative data processing between edge AI computing server A and IoT terminals B and C, server A's operating system generates a batch of behavioral data every 5 minutes. The system divides window segments according to parameters of "window duration 5 minutes, window overlap rate 50%". Within a certain window, the "computing resource application" event occurred 30 times, the "data transmission" event occurred 40 times, and the "permission verification" event occurred 20 times, for a total of 90 events within that window. Calculations show that the distribution density of the "permission verification" event is approximately 0.22 (20 divided by 90); the distribution density of the "computing resource application" event is approximately 0.33 (30 divided by 90); and the distribution density of the "data transmission" event is approximately 0.44 (40 divided by 90). Meanwhile, the number of times the "computing resource application" event occurred after the "authorization verification" event was 18, and the number of times the "data transmission" event occurred after the "computing resource application" event was 25. The corresponding transition probabilities are 18 divided by 20, which is 0.9; and 25 divided by 30, which is approximately 0.83. Finally, the distribution density is arranged in the order of "authorization verification", "computing resource application" and "data transmission", and the transition probabilities are arranged in the order of "authorization verification to computing resource application" and "computing resource application to data transmission", forming a behavioral feature vector of [0.22, 0.33, 0.44, 0.9, 0.83].

[0085] In the overall scheme of step S102 above, the behavioral data is divided by sliding time windows, which can capture the behavioral change characteristics in different time periods and avoid the limitations of single time node analysis. By calculating the distribution density and transition probability, the behavioral characteristics can be quantified from two dimensions: "event activity level" and "event correlation pattern", making the originally scattered behavioral data analyzable. By constructing behavioral feature vectors, unstructured time series data can be transformed into structured mathematical vectors, providing a standardized data format for subsequent time series mapping and trust assessment, ensuring that the subsequent analysis process is both accurate and easy to understand.

[0086] S103. Map the behavior feature vector into a time sequence graph, where nodes correspond to system entities and edges correspond to entity interaction relationships, and assign dynamic weight values ​​to the edges of the time sequence graph according to the real-time security policy and interaction intensity.

[0087] Optionally, step S103 may specifically include the following steps:

[0088] S1031. Identify the system entities involved in the behavior feature vector as nodes, and based on the event sequence recorded in the behavior feature vector, establish connection edges between entity nodes with interactive relationships to construct a time sequence graph.

[0089] S1032. Calculate the initial interaction strength of each edge based on the frequency, duration and resource consumption level of the interaction behavior between entities.

[0090] S1033. Adjust the initial interaction intensity according to the rules defined in the real-time security policy to obtain the corresponding dynamic weight value, and assign the dynamic weight value to the corresponding edge in the time sequence graph.

[0091] In the above steps, a sequence diagram is a model that graphically presents the interaction relationships between system entities over a continuous period of time. Its core function is to intuitively display the dynamic interaction states between entities. System entities refer to various subjects participating in server operation and data interaction, including processes, files, hardware modules, and IoT terminals that coordinate with the server. Entity interaction relationships refer to the associations formed between different system entities due to operations such as data transmission, resource calls, and permission requests. Interaction intensity refers to an indicator used to quantify the frequency and impact of interactions between entities, which is determined by interaction frequency, duration, and resource consumption level. Real-time security policy refers to a set of dynamic rules formulated based on the current system security requirements and risk status, used to guide security protection behavior. Dynamic weight values ​​refer to the values ​​assigned to the connecting edges in the sequence diagram after adjustments based on interaction intensity and real-time security policy, used to reflect the security risk level and importance of the corresponding interaction relationship.

[0092] In this embodiment, step S1031 first parses the event sequence recorded in the behavior feature vector, extracts the system entities involved, and treats each entity as an independent node in the time sequence graph. For example, three types of system entities are identified from the event sequence: "server process A," "terminal device B," and "database file C," and three corresponding nodes are established for each. Then, based on the interactive behaviors recorded in the event sequence, it is determined whether there is an interaction relationship between different entity nodes. If an interaction relationship exists, connection edges are established between the corresponding nodes, thereby constructing an initial time sequence graph. For example, if the event sequence contains the interactive behaviors "terminal device B calls server process A" and "server process A reads database file C," then connection edges are established between "terminal device B" and "server process A," and between "server process A" and "database file C," respectively, forming an initial time sequence graph containing three nodes and two connection edges.

[0093] Secondly, in step S1032, for each established connection edge in the time sequence graph, the frequency of interaction behavior between the corresponding entities is first counted, i.e., the number of interactions occurring per unit time; then, the duration of each interaction is recorded and the average duration is calculated; simultaneously, the system resources consumed by each interaction (such as CPU usage and memory usage) are counted and the average resource consumption level is calculated. Then, a weighted summation algorithm is used to assign weight coefficients to the interaction frequency, average duration, and average resource consumption level (the weight coefficients can be preset according to the system's emphasis on different indicators). The three indicators are multiplied by their corresponding weight coefficients and summed to obtain the initial interaction strength of each edge. For example, regarding the connection edge between "Terminal Device B" and "Server Process A", the statistics show that the interaction frequency per unit time is 10 times, the average duration is 2 minutes, and the average memory consumption is 500MB. The preset frequency weight coefficient is 0.4, the duration weight coefficient is 0.3, and the resource consumption weight coefficient is 0.3. Then, the initial interaction strength is 10×0.4+2×0.3+500×0.3 (Note: In actual calculation, each indicator needs to be standardized to ensure that the numerical magnitude is consistent. Here, only the calculation logic is shown for simplification). Finally, the initial interaction strength value of the connection edge is obtained.

[0094] Next, in step S1033, the currently effective real-time security policy is retrieved, and the rules related to entity interaction are parsed. For example, the real-time security policy stipulates that "interactions between terminal devices and core processes need to have their risk weight increased" and "interactions during non-working hours need to have their risk weight increased." Then, the initial interaction intensity obtained in step S1032 is adjusted according to these rules. If the interaction behavior conforms to the rule in the policy that requires increased risk, the initial interaction intensity is multiplied by an adjustment coefficient greater than 1; if it conforms to the rule in the policy that requires decreased risk, it is multiplied by an adjustment coefficient less than 1. The adjusted value is the dynamic weight value, and this dynamic weight value is assigned to the corresponding connection edge in the sequence graph. For example, the interaction between "Terminal Device B" and "Server Process A" occurs during non-working hours, and "Server Process A" is a core process, which meets the rule of "increasing risk weight" in the real-time security policy. The preset adjustment coefficient is 1.5. If the initial interaction strength of this connection edge is 20, then the dynamic weight value is 20 × 1.5 = 30. The value of 30 is assigned to the connection edge between "Terminal Device B" and "Server Process A". The interaction between "Server Process A" and "Database File C" meets the normal working rules, the adjustment coefficient is set to 1.0, the initial interaction strength is 15, and the dynamic weight value is 15 × 1.0 = 15. The value of 15 is assigned to the corresponding connection edge.

[0095] In practical applications, edge AI computing server D collaborates with IoT terminals E and F to process industrial data. The behavioral feature vector of server D identifies four system entities: "server computing module G," "terminal E," "terminal F," and "industrial database H," thus establishing four nodes. Based on the event sequence, connection edges are established between "terminal E-computing module G," "terminal F-computing module G," and "computing module G-industrial database H." The initial interaction strength of each edge is then calculated: "Terminal E-computing module G" interaction frequency: 8 times, average duration: 1.5 minutes, average CPU consumption: 30%, initial interaction strength calculated as 18; "Terminal F-computing module G" interaction frequency: 5 times, average duration: 1 minute, average CPU consumption: 20%, initial interaction strength: 12; "computing module G-industrial database H" interaction frequency: 12 times, average duration: 2.5 minutes, average storage consumption: 40%, initial interaction strength: 25. At this point, the real-time security policy stipulates that "industrial data interaction needs to have its weight increased" and "terminal F is a temporary access device and its weight needs to be increased." Therefore, the adjustment coefficient of "terminal F - computing power module G" is set to 1.6, and the dynamic weight value is 12 × 1.6 = 19.2; the adjustment coefficient of "computing power module G - industrial database H" is set to 1.4, and the dynamic weight value is 25 × 1.4 = 35; "terminal E - computing power module G" has no special rules, the adjustment coefficient is 1.0, and the dynamic weight value is 18. Finally, the dynamic weight assignment of the time sequence graph edges is completed.

[0096] In the overall solution of step S103 above, by mapping behavioral feature vectors to a time sequence diagram, abstract behavioral data is transformed into an intuitive graphical model, making the interaction relationships between system entities easier to understand. By calculating the initial interaction intensity, the activity level and impact range of entity interactions are quantified, providing a basis for subsequent security assessments. By combining real-time security policies with dynamic weight values, the time sequence diagram can reflect the interaction risk level under current security requirements, avoiding the problem that fixed weights cannot adapt to dynamic security scenarios. The overall solution ensures technical expertise while reducing the difficulty of understanding through graphical and quantitative methods, laying a reliable foundation for continuous monitoring of entity interaction behavior and generating dynamic trust indicators.

[0097] S104. Based on the dynamic weight values, continuously monitor and analyze the dynamic interaction behavior between entities in the time series diagram to obtain the behavior representation of the system in continuous time.

[0098] Optionally, step S104 may specifically include the following steps:

[0099] S1041. Within each sliding time window, extract the entity pairs connected by each edge in the time sequence graph and the corresponding dynamic weight values ​​as the entity interaction features of the current window.

[0100] S1042. For each system entity, aggregate the dynamic weight values ​​of all associated edges within the current time window and calculate the entity's comprehensive activity index.

[0101] S1043. Calculate the stability index of the interaction relationship between entities based on the dynamic weight changes of the same entity pair between adjacent time windows.

[0102] Specifically, step S1043 may include the following steps: obtaining the dynamic weight values ​​corresponding to the same entity pair in the current time window and the previous adjacent time window; calculating the change between the dynamic weight value of the current time window and the dynamic weight value of the previous adjacent time window; determining the interaction stability score of the entity pair between adjacent time windows based on the absolute value of the change and in combination with a preset change threshold; aggregating the interaction stability scores of all entity pairs to calculate the overall interaction relationship stability index of the system.

[0103] S1044. The entity interaction features, the comprehensive activity index, and the stability index are combined in chronological order to form a behavioral representation of the system over continuous time.

[0104] In the above steps, entity interaction features refer to the combination of entity pairs corresponding to each edge in the time sequence graph and the dynamic weight value of that edge within each sliding time window, used to record the interaction objects and risk levels between entities within a specific time period; the comprehensive activity index is a quantitative indicator obtained by aggregating the dynamic weight values ​​of all associated edges of a single system entity, used to reflect the activity level of the entity within the current time window; the stability index includes entity pair interaction stability score and system overall interaction relationship stability index. The former is used to measure the change in the interaction risk of the same entity pair within adjacent time windows, while the latter is obtained by aggregating the stability scores of all entity pairs, used to reflect the stability of the overall interaction state of the system; the behavioral representation is a dataset formed by combining entity interaction features, comprehensive activity index, and stability index of different time windows in chronological order, used to fully present the changes in the operating state of the system over continuous time.

[0105] In this embodiment, firstly, in step S1041, within each sliding time window period, the timing graph corresponding to the window is parsed, and the two system entities connected by each edge in the graph are extracted to form entity pairs. At the same time, the dynamic weight value corresponding to each edge is extracted, and the entity pairs are bound with the corresponding dynamic weight values ​​to form the entity interaction features of the current window. For example, if the timing graph in a certain sliding time window contains three edges, corresponding to the entity pairs "Terminal A-Process B", "Process B-Database C", and "Terminal D-Process B", with dynamic weight values ​​of 25, 18, and 22 respectively, then the entity interaction features of the current window are the set of (Terminal A-Process B, 25), (Process B-Database C, 18), and (Terminal D-Process B, 22).

[0106] Secondly, in step S1042, for each system entity, all edges associated with that entity in the time sequence graph are first selected, and then the dynamic weight values ​​corresponding to these edges are extracted. The average of these dynamic weight values ​​is calculated using an arithmetic average algorithm to obtain the comprehensive activity index of the entity. If there are significant differences in the dynamic weight values ​​of the edges associated with the entity, a weighted average algorithm can also be used to calculate the index based on the preset weights according to the interaction importance of the edges. For example, if the system entity "Process B" is associated with three edges with dynamic weight values ​​of 25, 18, and 22 respectively, the comprehensive activity index calculated using the arithmetic average algorithm is (25+18+22)÷3=21.67; if the preset weight coefficients for "Terminal-Process" type edges are 0.6 and "Process-Database" type edges are 0.4, the comprehensive activity index calculated using the weighted average algorithm is 25×0.6+18×0.4+22×0.6=22.8. The specific algorithm can be selected according to the system requirements.

[0107] Next, in step S1043, the dynamic weight values ​​corresponding to the same entity pair in the current time window and the previous adjacent time window are obtained. The difference between the dynamic weight value of the current window and the dynamic weight value of the previous window is calculated, and the absolute value of this difference is taken as the change. Then, a preset change threshold is retrieved. This threshold is set according to the system's tolerance for interaction fluctuations, for example, it is set to 5. If the change is less than or equal to the change threshold, it indicates that the interaction fluctuation is small, and a higher stability score is assigned (e.g., 8-10 points on a 10-point scale); if the change is greater than the change threshold, it indicates that the interaction fluctuation is large, and a lower stability score is assigned (e.g., 1-7 points on a 10-point scale). After that, the stability scores of all entity pairs are averaged using an arithmetic mean algorithm to obtain the overall interaction relationship stability index of the system. For example, the entity "Terminal A - Process B" has a dynamic weight of 23 in the previous window and 25 in the current window, with a change of |25-23|=2, which is less than the preset threshold of 5, and is given a stability score of 9. The entity "Process B - Database C" has a dynamic weight of 20 in the previous window and 18 in the current window, with a change of 2, and is given a score of 9. The entity "Terminal D - Process B" has a dynamic weight of 17 in the previous window and 22 in the current window, with a change of 5, which is equal to the threshold, and is given a score of 8. The overall system stability index is (9+9+8)÷3≈8.67.

[0108] Finally, in step S1044, according to the order of the sliding time windows, the entity interaction features corresponding to each window, the comprehensive activity index of all entities, and the overall system interaction stability index are arranged sequentially to form a dataset organized by the time dimension. This dataset is the behavioral representation of the system in continuous time. For example, suppose windows 1 to 3 are ordered in chronological order. The entity interaction features of window 1 are (terminal A-process B, 25), the comprehensive activity index is process B: 21.67, and the stability index is 8.67; the corresponding data for window 2 are (terminal A-process B, 26), process B: 22.33, and the stability index is 9.0; the corresponding data for window 3 are (terminal A-process B, 24), process B: 21.0, and the stability index is 8.33. Combining these data in the order of window 1, window 2, and window 3 forms the behavioral representation of the system in continuous time.

[0109] In practical applications, the edge AI computing server E collaborates with IoT terminals F and G to process medical data, with a sliding time window set to 10 minutes. Within a certain time period, there are three adjacent windows: Window 1, Window 2, and Window 3. In Window 1, the time sequence graph entity pairs are "Terminal F - Computing Module H", "Computing Module H - Medical Database I", and "Terminal G - Computing Module H", with dynamic weight values ​​of 30, 22, and 25 respectively. The calculated comprehensive activity index of "Computing Module H" is (30+22+25)÷3=25.67. Compared with the previous window (not within the window 1-3 sequence in this statistical analysis), the change in each entity pair is less than the preset threshold of 6, with stability scores of 9, 9, and 8 respectively, and a system stability index of 8.67. In window 2, the entity pairs remain unchanged, and the dynamic weight values ​​are 32, 23, and 27 respectively; the comprehensive activity index of "Calculation Module H" is (32+23+27)÷3=27.33; compared with window 1, the changes are 2, 1, and 2 respectively, the stability score is 9 for all three windows, and the system stability index is 9.0. In window 3, the entity pairs remain unchanged, and the dynamic weight values ​​are 29, 21, and 24 respectively; the comprehensive activity index of "Calculation Module H" is (29+21+24)÷3=24.67; compared with window 2, the changes are 3, 2, and 3 respectively, the stability score is 9 for all three windows, and the system stability index is 9.0. Combining the above data from the three windows in chronological order yields the behavioral representation of server E during that period.

[0110] In the overall scheme of step S104 above, by extracting entity interaction features, the interaction objects and risk levels between entities within each time period can be accurately captured, providing specific interaction information for subsequent analysis; by calculating the comprehensive activity index, the activity status of individual entities can be intuitively reflected, facilitating the rapid identification of abnormally active or abnormally inactive entities; by calculating the stability index, the magnitude of changes in interaction status can be quantified, allowing for timely detection of fluctuations in the overall system interaction; and by combining these to form a behavioral representation, the continuous operational status of the system can be fully presented, avoiding the limitations of single-window data. The overall scheme ensures the accuracy of the analysis through quantitative indicators and makes system state changes easier to understand through the combination of time dimensions, providing comprehensive and structured data support for subsequent comparison with baseline behavioral patterns and the generation of dynamic trust indicators.

[0111] S105. Based on the behavioral representation and the behavior pattern of the benchmark device, a difference assessment is performed to obtain the degree of deviation between the current system and the normal system, and a dynamic trust index is generated based on the degree of deviation.

[0112] Optionally, step S105 may specifically include the following steps:

[0113] S1051. By acquiring the historical behavior representation of the reference device under normal working conditions, a reference behavior pattern is established. The behavior representation of the current system is compared with the reference behavior pattern item by item, and the difference value of each feature is calculated.

[0114] S1052. Based on the degree of influence of different features on the system security status, assign corresponding weight coefficients to the difference values ​​of each feature, and perform weighted calculation on all feature difference values ​​based on the weight coefficients to obtain the degree of deviation between the current system and the normal system.

[0115] S1053. The deviation degree is converted into a standardized dynamic trust index through a preset mapping relationship.

[0116] In the above steps, the baseline device behavior pattern refers to the standard behavior model constructed by the baseline device through historical behavior representation under normal working conditions, which is used as a reference to judge whether the current system is operating normally; the difference assessment refers to the process of comparing and analyzing the behavior representation of the current system with the baseline behavior pattern to quantify the difference between the two; the deviation degree is a comprehensive index obtained by weighting the difference values ​​of various features, which is used to reflect the overall deviation level of the current system from the normal state; the dynamic trust index is a standardized value obtained by converting the deviation degree through a preset mapping relationship, which is used to intuitively reflect the trustworthiness of the current system, and the value is inversely proportional to the trustworthiness of the system.

[0117] In this embodiment, firstly, step S1051 collects historical behavioral representations generated by the benchmark device under normal operating conditions. These representations include entity interaction features, comprehensive activity indices, and stability indices for multiple time windows. These historical data are statistically analyzed, and their average level or typical pattern is taken as the benchmark behavioral pattern. Then, the behavioral representation of the current system is compared with the benchmark behavioral pattern item by item according to the same feature items. The difference value of each feature is calculated using the absolute difference method, that is, the absolute value is taken after subtracting the current feature value from the benchmark feature value. For example, in the benchmark behavioral pattern, the comprehensive activity index of process B in a certain window is 20 and the stability index is 8.5. In the current system, the comprehensive activity index of process B in the corresponding window is 25 and the stability index is 7.0. Therefore, the difference in comprehensive activity index is |25-20|=5, and the difference in stability index is |7.0-8.5|=1.5.

[0118] Secondly, in step S1052, weight coefficients are preset based on the degree of influence of each feature on the system's security status. Features with higher influence have larger weight coefficients. For example, the comprehensive activity index is directly related to the risk of system resource abuse, and its weight coefficient is set to 0.4; the stability index reflects the risk of system interaction fluctuations, and its weight coefficient is set to 0.3; the weight coefficient for features involving access to core resources in entity interaction features is set to 0.3. Then, the difference value of each feature is multiplied by its corresponding weight coefficient, and all products are summed. The total sum is the degree of deviation between the current system and the normal system. For example, if the comprehensive activity index difference value is 5 with a corresponding weight of 0.4, the stability index difference value is 1.5 with a corresponding weight of 0.3, and a core entity interaction feature difference value is 3 with a corresponding weight of 0.3, then the degree of deviation is 5 × 0.4 + 1.5 × 0.3 + 3 × 0.3 = 2 + 0.45 + 0.9 = 3.35.

[0119] Next, in step S1053, a mapping relationship between the deviation level and the dynamic trust index is preset. This relationship can be a linear mapping or a piecewise mapping. For example, the dynamic trust index is set to 100 (completely trustworthy) when the deviation level is 0, and 0 (completely untrustworthy) when the deviation level is 10. Intermediate values ​​are converted linearly. Substituting the deviation level obtained in step S1052 into this mapping relationship, the standardized dynamic trust index is calculated. For example, if the deviation level is 3.35, the dynamic trust index calculated using the linear mapping relationship is 100 - (3.35 × 10) = 66.5. This value directly reflects the current trust level of the system.

[0120] In practical applications, the baseline behavior pattern of edge AI computing server A is constructed using historical data from its normal operation, including baseline values ​​such as the entity pair interaction features between terminal B and computing module C, the comprehensive activity index of computing module C, and system stability index. At a certain moment, in the current system behavior representation, the difference in interaction features between terminal B and computing module C is 4, the difference in comprehensive activity index of computing module C is 6, and the difference in system stability index is 2. The preset weight coefficients for the three features are 0.3, 0.5, and 0.2, respectively. The calculated deviation is 4×0.3 + 6×0.5 + 2×0.2 = 1.2 + 3 + 0.4 = 4.6. Further transformation according to the preset mapping relationship shows that a deviation of 0 corresponds to a trust index of 100, and a deviation of 10 corresponds to a trust index of 0. The dynamic trust index is 100 - (4.6 × 10) = 54, indicating that the current system's trustworthiness is at a medium level.

[0121] In the overall scheme of step S105 above, by establishing a benchmark behavior pattern, a clear reference for the normal state of the system is provided, avoiding judgment bias caused by the lack of standards; by calculating the difference values ​​item by item and weighting them to obtain the degree of deviation, the impact of different characteristics on system security can be comprehensively considered, making the assessment results more in line with actual risks; by converting the degree of deviation into a dynamic trust index, the abstract degree of deviation is transformed into an intuitive and easy-to-understand value, facilitating subsequent security strategy decisions. The overall scheme takes into account both the comprehensiveness of the assessment and the readability of the results, providing an accurate risk judgment basis for the dynamic adjustment of the zero-trust strategy.

[0122] S106. When the dynamic trust index exceeds the preset range, the zero trust policy decision mechanism is triggered to optimize the resource access permissions and computing task allocation strategy of the dynamic configuration server through multi-objective optimization.

[0123] Optionally, such as Figure 2 As shown, step S106 may specifically include the following steps:

[0124] S1061. When the dynamic trust index exceeds the preset range, the zero trust strategy decision mechanism is activated to establish a composite optimization objective that includes resource isolation requirements and computing performance requirements.

[0125] S1062. Based on the degree of deviation of the dynamic trust index, determine the constraint level of resource access permission and the security level of computing task allocation, so as to construct a multi-dimensional constraint set containing permission constraints and task allocation conditions.

[0126] Specifically, step S1062 may include the following processes: dividing the numerical range of the dynamic trust index into multiple consecutive trust intervals, each trust interval corresponding to a preset basic constraint level and a basic security level; calculating the constraint level adjustment amount and the security level adjustment amount based on the deviation distance of the boundary of the trust interval corresponding to the dynamic trust index; superimposing the basic constraint level and the constraint level adjustment amount to obtain the constraint level; superimposing the basic security level and the security level adjustment amount to obtain the security level; selecting matching permission constraints from a predefined permission template library based on the constraint level, the permission constraints including a set of resource types accessible to the system entity and a set of operation types allowed to be executed; selecting matching task allocation conditions from a predefined task template library based on the security level, the task allocation conditions including calculating the resource quota range and execution priority range that can be allocated to the task; and combining the permission constraints and task allocation conditions to form a multi-dimensional constraint set.

[0127] S1063. Under the premise of satisfying the multi-dimensional constraint set, the composite optimization objective is processed synchronously using a collaborative optimization method, and resource access permission configuration scheme and computing task allocation scheme are generated in parallel.

[0128] Specifically, step S1063 may include the following processes: based on the resource isolation requirements in the composite optimization objective and the permission constraints in the multi-dimensional constraint set, the correspondence between system entities and resource access permissions is iteratively adjusted to generate a resource access permission configuration scheme; based on the computational performance requirements in the composite optimization objective and the task allocation conditions in the multi-dimensional constraint set, the allocation relationship between computational tasks and resource quotas is iteratively adjusted to generate a computational task allocation scheme; the resource access permission configuration scheme and the computational task allocation scheme are coupled and verified to ensure that there is no conflict between the two schemes in resource allocation; when the coupling verification passes, the resource access permission configuration scheme and the computational task allocation scheme are output.

[0129] S1064. Convert the resource access permission configuration scheme into specific access control rules, and convert the computing task allocation scheme into a task scheduling strategy;

[0130] S1065. Integrate the access control rules and task scheduling policies into a unified security policy set, and distribute the security policy set to the policy execution module of the server.

[0131] In the above steps, the zero-trust policy decision mechanism refers to the core mechanism activated when the system's dynamic trust indicators are abnormal, used to formulate and execute security policies; the composite optimization objective is a dual objective including resource isolation requirements and computational performance requirements. Resource isolation requirements are used to limit the resource access scope of risky entities, while computational performance requirements are used to ensure the efficiency of computing power allocation for normal business operations; the multi-dimensional constraint set is a set of constraints derived from resource access permission constraint levels and computational task allocation security levels, including permission constraints and task allocation conditions; the collaborative optimization method is an algorithm that synchronously processes resource configuration and task allocation, used to balance the dual optimization objectives while satisfying the constraints; the security policy set is a unified scheme that integrates access control rules and task scheduling policies, used to be distributed to the execution module to achieve security management.

[0132] In this embodiment, firstly, step S1061 presets a normal range for the dynamic trust index. When the current system's dynamic trust index exceeds this range, the zero-trust policy decision mechanism is automatically activated. Subsequently, based on system security requirements and business operation requirements, a composite optimization objective is established. The resource isolation requirement explicitly restricts high-risk entities' access to core resources (such as databases and computing modules), while the computing performance requirement explicitly ensures that the basic computing power allocation for normal terminals is not lower than a preset level. For example, the normal range for the dynamic trust index is set to 60-100. When the current index is 50, the decision mechanism is activated, and the composite optimization objective is set as "restricting risky terminals' access to the core database" and "ensuring that the computing power allocation for normal terminals is not less than 60% of the total computing power."

[0133] Secondly, in step S1062, the numerical range of the dynamic trust index is divided into multiple continuous trust intervals. Each interval corresponds to a preset basic constraint level and basic security level. For example, the index 80-100 corresponds to basic constraint level 1 and basic security level 1; 60-80 corresponds to basic constraint level 2 and basic security level 2; 40-60 corresponds to basic constraint level 3 and basic security level 3; and below 40 corresponds to basic constraint level 4 and basic security level 4. Then, the deviation distance between the current index and the corresponding interval boundary is calculated. Based on the deviation distance, the constraint level adjustment amount and security level adjustment amount are determined. For example, if the index 50 is in the 40-60 interval, the midpoint of the interval is 50, the deviation distance is 0, and the adjustment amount is 0. If the index is 45, the deviation distance from the midpoint of the interval is 5, and the adjustment amount is set to 0.5. Finally, the basic level and the adjustment amount are superimposed to obtain the final level. The basic constraint level 3 corresponding to index 50 plus the adjustment amount 0 results in a final constraint level of 3; the basic security level 3 plus the adjustment amount 0 results in a final security level of 3. Next, select permission constraints matching level 3 from the predefined permission template library, such as "risky terminals can only access non-core files and cannot perform write operations"; select task allocation conditions matching level 3 from the task template library, such as "the computing power quota of risky terminals does not exceed 20% of the total computing power, and the execution priority is set to the lowest". Finally, combine the two conditions to form a multi-dimensional constraint set.

[0134] Next, in step S1063, a collaborative optimization method is used to simultaneously process the composite optimization objective and the multi-dimensional constraint set. On one hand, based on resource isolation requirements and permission constraints, the correspondence between system entities and resource access permissions is iteratively adjusted. For example, the access permission of risky terminal A is limited to "read only non-core folder F1", while the access permission of normal terminal B is retained to "read and write to core database D1", generating a resource access permission configuration scheme. On the other hand, based on computational performance requirements and task allocation conditions, the allocation relationship between computational tasks and resource quotas is iteratively adjusted. For example, the computational power quota of risky terminal A is set to 15% of the total computational power, and the computational power quota of normal terminal B is set to 30% of the total computational power, generating a computational task allocation scheme. The two schemes are then coupled and verified to check for resource conflicts. For example, it is confirmed that the computational power quota and access permission of terminal A do not exceed the constraints, and the quota of terminal B does not affect the overall performance. After successful verification, both schemes are output.

[0135] Then, through step S1064, the resource access permission configuration scheme is converted into an executable access control rule. For example, "Terminal A only reads non-core folder F1" is converted into "Allow the IP address of terminal A to access folder F1 from 8:00 to 18:00 every day, only open the read port and close the write port"; the computing task allocation scheme is converted into a task scheduling policy. For example, "Terminal A computing power quota 15%, lowest priority" is converted into "The scheduling system allocates 15% of CPU and memory resources to terminal A, and all tasks are queued after normal terminal tasks".

[0136] Finally, in step S1065, the converted access control rules and task scheduling policies are integrated into a unified security policy set, such as a set containing "Terminal A Access Control Rules," "Terminal B Access Control Rules," "Terminal A Task Scheduling Policy," and "Terminal B Task Scheduling Policy." This security policy set is then distributed to the server's policy execution module via the server's policy transmission channel. The execution module applies the policies in real time, enabling dynamic control over server resource access and task allocation.

[0137] In practical applications, edge AI computing server C collaborates with IoT terminals D and E to process logistics data. The normal range for the dynamic trust index is set at 60-100. At a certain moment, terminal D's abnormal behavior causes the system's dynamic trust index to drop to 48, exceeding the normal range, thus activating the zero-trust policy decision mechanism. The composite optimization objective is set as "isolating terminal D's access to the core logistics database" and "ensuring terminal E's computing power for logistics data processing." Through S1062, the index 48 falls within the 40-60 range, with a basic constraint level of 3 and a basic security level of 3. The deviation from the midpoint of the range is 2, resulting in a constraint level adjustment of 0.3 and a security level adjustment of 0.3, ultimately achieving a constraint level of 3.3 and a security level of 3.3. The matched permission constraint condition is "terminal D can only access the logistics historical data folder and cannot modify the data," and the task allocation condition is "terminal D's computing power quota does not exceed 18%, and its priority is lower than terminal E." After generating the configuration scheme through S1063, it is converted into access control rules "Allow terminal D to access the historical data folder, disable modification permissions" and task scheduling policy "Terminal D computing power quota 16%, priority lower than terminal E", which are integrated into a security policy set and sent to the execution module to realize security control of terminal D and performance guarantee of terminal E.

[0138] In the overall solution of step S106 above, by activating the zero-trust policy decision-making mechanism and establishing composite optimization objectives, a rapid response can be achieved when risks occur, while simultaneously considering both security and efficiency requirements. By constructing a multi-dimensional constraint set, the control intensity can be precisely set according to trust indicators, avoiding excessive or insufficient protection. By generating configuration schemes through collaborative optimization methods, resource and task allocation can be ensured to be conflict-free, guaranteeing policy feasibility. By transforming and integrating the security policy set, standardized implementation and efficient execution of policies can be achieved. The overall solution forms a complete closed loop from risk triggering to policy effectiveness, ensuring the secure operation of edge AI computing servers without affecting the collaborative computing efficiency of normal business operations, providing a feasible implementation path for zero-trust security dynamic configuration.

[0139] The following is a complete embodiment for steps S101 to S106:

[0140] like Figure 3As shown, in a smart manufacturing scenario, edge AI computing server A needs to collaborate with IoT terminal B to collect equipment status data and terminal C to analyze and process production data in real time. First, server A collects behavioral data generated by its own operating system, including process startup events initiated by terminal B, file read events from the database by terminal C, and resource call records from the hardware computing module. Then, the behavioral data is divided into 5-minute sliding time windows. Within a certain window, process startup events occur 20 times, file read events occur 30 times, and resource call events occur 25 times, for a total of 75 events. The calculated distribution densities are 20÷75≈0.27, 30÷75=0.4, and 25÷75≈0.33, respectively. Simultaneously, event correlations are analyzed: after process startup, file read events occur 15 times with a transition probability of 15÷20=0.75; after file read events, resource calls occur 20 times with a transition probability of 20÷30≈0.67. A behavioral feature vector is constructed [0.27, 0.4, 0.33, 0.75, 0.67].

[0141] Next, the feature vector is mapped to a time-series graph, with nodes set as terminal B, terminal C, database, and computing module. Edges are established between terminal B and the computing module, terminal C and the database, and the database and the computing module based on the event sequence. The initial interaction strengths are calculated as follows: terminal B and computing module: 18; terminal C and database: 22; database and computing module: 25. Combining this with real-time security policy data analysis, the dynamic weights are adjusted to prioritize database access, resulting in values ​​of 20, 25, and 25. Based on continuous monitoring of these dynamic weights, entity interaction features are extracted, such as the weight of 25 corresponding to terminal C and the database. The comprehensive activity index of terminal C (25) plus the average of other associated edge weights equals 24. Comparison of adjacent windows yields an interaction stability index of 8.5. These are combined in chronological order to form a behavioral representation.

[0142] Comparing this behavior pattern with the baseline behavior pattern of server A during normal operation, the calculated comprehensive activity difference value is 4, the stability difference value is 1.2, and the weighted deviation is 3.5, which is mapped to a dynamic trust index of 65, which is within the normal range of 60 to 100. When terminal B initiates high-frequency resource calls due to abnormal software, causing the dynamic trust index to drop to 50 and exceed the range, the zero-trust policy decision mechanism is triggered. A composite optimization goal is set to isolate terminal B from the core computing power and ensure the data analysis computing power of terminal C. Constraints are constructed, such as terminal B only being able to access non-core resources and computing power quota not exceeding 20%. Through collaborative optimization, a configuration scheme is generated and converted into access control rules to close terminal B's access port to the core computing power module and increase terminal C's computing power quota to 40%. After integration, the scheme is issued and executed.

[0143] The zero-trust security dynamic configuration method for edge AI computing servers provided in this application achieves closed-loop control from behavioral data collection to security policy implementation through full-process dynamic perception and quantitative analysis of the behavioral characteristics of edge AI computing servers. Its core advantages are: First, based on sliding time windows and time sequence graph modeling, it accurately captures the dynamic patterns of entity interactions, avoiding the omission of instantaneous risks by static analysis; second, it quantifies the degree of system deviation through dynamic trust indicators, providing an objective decision-making basis for zero-trust policies and overcoming the limitations of traditional security configurations that rely on experience-based judgment; third, it combines multi-objective optimization to dynamically adjust resource permissions and task allocation, balancing the contradiction between security protection and computing efficiency while ensuring system security isolation and taking into account business computing power needs. The overall solution enables edge AI computing servers to adaptively respond to dynamic risks, improving security controllability and continuous service capabilities in complex collaborative scenarios.

[0144] Figure 4 This is a schematic diagram illustrating a specific implementation of a zero-trust security dynamic configuration system for edge AI computing servers provided in this application. (Refer to...) Figure 4 The system may include:

[0145] Acquisition module 41 is used to acquire behavioral data generated by the operating system of the edge AI computing server.

[0146] The calculation module 42 is used to divide the behavioral data according to the sliding time window and calculate the distribution density of event types and the transition probability between events within each window segment in order to construct a behavioral feature vector.

[0147] The mapping module 43 is used to map the behavior feature vector into a time sequence graph, wherein nodes correspond to system entities and edges correspond to entity interaction relationships, and dynamic weight values ​​are assigned to the edges of the time sequence graph according to the real-time security policy and interaction intensity.

[0148] Monitoring module 44 is used to continuously monitor and analyze the dynamic interaction behavior between entities in the time series diagram based on the dynamic weight value, so as to obtain the behavior representation of the system in continuous time.

[0149] The generation module 45 is used to evaluate the difference between the behavior representation and the behavior pattern of the benchmark device, obtain the degree of deviation between the current system and the normal system, and generate a dynamic trust index based on the degree of deviation.

[0150] The decision module 46 is used to trigger a zero-trust policy decision mechanism when the dynamic trust index exceeds a preset range, and to optimize the resource access permissions and computing task allocation strategy of the dynamic configuration server through multi-objective optimization.

[0151] The edge AI computing server zero-trust security dynamic configuration system of this application embodiment is used to implement the aforementioned edge AI computing server zero-trust security dynamic configuration method. Therefore, the specific implementation of the edge AI computing server zero-trust security dynamic configuration system can be found in the embodiment section of the edge AI computing server zero-trust security dynamic configuration method above. The specific implementation can be referred to the description of the corresponding embodiment, and will not be repeated here.

[0152] This application also provides an electronic device, including: a memory for storing a computer program; and a processor for executing the computer program to implement the steps of the zero-trust security dynamic configuration method for edge AI computing power servers described above.

[0153] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of any of the above-described edge AI computing server zero-trust security dynamic configuration methods.

[0154] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as USB flash drives, read-only memory, random access memory, portable hard drives, magnetic disks, or optical disks.

[0155] Embodiments of the present invention also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above embodiments of the zero-trust security dynamic configuration method for edge AI computing power servers.

[0156] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0157] The foregoing has provided a detailed description of a zero-trust security dynamic configuration method and system for edge AI computing servers provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are merely for the purpose of helping to understand the method and its core ideas. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of this application.

Claims

1. An edge AI computing power server zero-trust security dynamic configuration method, characterized in that, The method comprises: acquiring behavior data generated by an edge AI computing server operating system running; dividing the behavior data according to a sliding time window, and calculating the distribution density of event types and the transition probability between events in each window segment to construct a behavior feature vector; mapping the behavior feature vector into a time sequence diagram, wherein the nodes correspond to system entities and the edges correspond to entity interaction relationships, and assigning dynamic weight values to the edges of the time sequence diagram according to real-time security policies and interaction intensities; based on the dynamic weight values, continuously monitoring and analyzing the dynamic interaction behavior between entities in the time sequence diagram to obtain the behavior representation of the system at continuous time; based on the behavior representation and a benchmark device behavior pattern, evaluating the difference degree to obtain the deviation degree of the current system from the normal system, and generating a dynamic trust index based on the deviation degree; when the dynamic trust index exceeds a preset range, triggering a zero trust policy decision mechanism to dynamically configure the resource access permissions and computing task allocation strategy of the server through multi-objective optimization; wherein, based on the dynamic weight values, continuously monitoring and analyzing the dynamic interaction behavior between entities in the time sequence diagram to obtain the behavior representation of the system at continuous time, comprising: in each sliding time window, extracting the entity pair connected by each edge in the time sequence diagram and the corresponding dynamic weight value as the entity interaction feature of the current window; for each system entity, aggregating the dynamic weight values of all associated edges in the current time window to calculate the comprehensive activity index of the entity; according to the change of the dynamic weight values of the same entity pair between adjacent time windows, calculating the stability index of the interaction relationship between entities; combining the entity interaction feature, the comprehensive activity index and the stability index in time sequence to form the behavior representation of the system at continuous time.

2. The method of claim 1, wherein, when the dynamic trust index exceeds a preset range, triggering a zero trust policy decision mechanism to dynamically configure the resource access permissions and computing task allocation strategy of the server through multi-objective optimization, comprising: when the dynamic trust index exceeds a preset range, activating a zero trust policy decision mechanism to establish a composite optimization objective including resource isolation requirements and computing performance requirements; according to the deviation degree of the dynamic trust index, determining the constraint level of resource access permissions and the security level of computing task allocation to construct a multi-dimensional constraint set including permission constraint conditions and task allocation conditions; under the premise of meeting the multi-dimensional constraint set, synchronously processing the composite optimization objective using a collaborative optimization method to generate a resource access permission configuration scheme and a computing task allocation scheme in parallel; converting the resource access permission configuration scheme into specific access control rules and the computing task allocation scheme into task scheduling strategies; integrating the access control rules and task scheduling strategies into a unified security policy set, and distributing the security policy set to the policy execution module of the server.

3. The method of claim 2, wherein, according to the deviation degree of the dynamic trust index, determining the constraint level of resource access permissions and the security level of computing task allocation to construct a multi-dimensional constraint set including permission constraint conditions and task allocation conditions, comprising: dividing a numerical range of the dynamic trust index into a plurality of continuous trust intervals, each of the trust intervals corresponding to a preset basic constraint level and a basic security level; calculating a constraint level adjustment and a security level adjustment according to a deviation distance of the dynamic trust index from a boundary of a corresponding trust interval; superimposing the basic constraint level and the constraint level adjustment to obtain a constraint level, and superimposing the basic security level and the security level adjustment to obtain a security level; selecting a matched permission constraint condition from a pre-defined permission template library based on the constraint level, the permission constraint condition including a set of resource types accessible by a system entity and a set of operation types allowed to be executed; selecting a matched task allocation condition from a pre-defined task template library based on the security level, the task allocation condition including a resource quota range and an execution priority range to which a computing task can be allocated; combining the permission constraint condition and the task allocation condition to form a multi-dimensional constraint set.

4. The method of claim 2, wherein, synchronously processing the composite optimization target by using a collaborative optimization method to generate a resource access permission configuration scheme and a computing task allocation scheme in parallel under the premise of satisfying the multi-dimensional constraint set, including: generating the resource access permission configuration scheme by iteratively adjusting a correspondence between a system entity and a resource access permission based on a resource isolation requirement in the composite optimization target and the permission constraint condition in the multi-dimensional constraint set; generating the computing task allocation scheme by iteratively adjusting an allocation relationship between a computing task and a resource quota based on a computing efficiency requirement in the composite optimization target and the task allocation condition in the multi-dimensional constraint set; performing coupling verification on the resource access permission configuration scheme and the computing task allocation scheme to ensure that there is no conflict between the two schemes in resource allocation, and outputting the resource access permission configuration scheme and the computing task allocation scheme when the coupling verification is passed.

5. The method of claim 1, wherein, performing difference evaluation on the behavior representation and a benchmark device behavior pattern to obtain a deviation degree of the current system from a normal system, and generating a dynamic trust index based on the deviation degree, including: establishing a benchmark behavior pattern by obtaining historical behavior representations of a benchmark device in a normal working state, comparing the behavior representation of the current system with the benchmark behavior pattern item by item, and calculating difference values of each feature; assigning a corresponding weight coefficient to the difference value of each feature according to the influence degree of different features on the system security state, and performing weighted calculation on all feature difference values based on the weight coefficient to obtain the deviation degree of the current system from the normal system; converting the deviation degree into a standardized dynamic trust index through a preset mapping relationship.

6. The method of claim 1, wherein, mapping the behavior feature vector into a time sequence diagram, where nodes correspond to system entities and edges correspond to entity interaction relationships, and assigning dynamic weight values to edges of the time sequence diagram according to real-time security policies and interaction intensities, including: identifying system entities involved in the behavior feature vector as nodes, and establishing connection edges between entity nodes with interaction relationships based on event sequences recorded in the behavior feature vector to construct a time sequence diagram; Calculate the initial interaction strength of each edge based on the frequency, duration and resource consumption level of the interaction behavior between entities; Adjust the initial interaction strength according to the rules defined in the real-time security policy to obtain the corresponding dynamic weight value, and assign the dynamic weight value to the corresponding edge in the time sequence diagram.

7. The method of claim 1, wherein, Divide the behavior data according to the sliding time window, and calculate the distribution density of event types and the transition probability between events in each window segment to construct a behavior feature vector, including: Divide the behavior data into continuous window segments in chronological order, and count the number of occurrences of each type of system event in each window segment to calculate the distribution density of each event type in the window segment; By analyzing the correlation between adjacent system events in the window segment, calculate the transition probability between event types in the window segment; Combine the distribution density and the transition probability in a predetermined order to form the behavior feature vector corresponding to the window segment.

8. The method of claim 1, wherein, According to the change of the dynamic weight value of the same entity pair between adjacent time windows, calculate the stability index of the interaction relationship between entities, including: Obtain the dynamic weight value of the same entity pair corresponding to the current time window and the previous adjacent time window, and calculate the change between the dynamic weight value of the current time window and the dynamic weight value of the previous adjacent time window; Based on the absolute value of the change, combined with the preset change threshold, determine the interaction stability score of the entity pair between adjacent time windows, aggregate the interaction stability scores of all entity pairs, and calculate the overall interaction relationship stability index of the system.

9. An edge AI computing server zero-trust security dynamic configuration system for performing the edge AI computing server zero-trust security dynamic configuration method of any one of claims 1-8. Including: An acquisition module for acquiring behavior data generated by the operation of an edge AI computing power server operating system; A calculation module for dividing the behavior data according to a sliding time window, and calculating the distribution density of event types and the transition probability between events in each window segment to construct a behavior feature vector; A mapping module for mapping the behavior feature vector to a time sequence diagram, where nodes correspond to system entities and edges correspond to entity interaction relationships, and assigning dynamic weight values to the edges of the time sequence diagram according to real-time security policies and interaction strength; A monitoring module for continuously monitoring and analyzing the dynamic interaction behavior between entities in the time sequence diagram based on the dynamic weight values to obtain the behavior representation of the system at consecutive times; A generation module for performing difference evaluation based on the behavior representation and the baseline device behavior pattern to obtain the deviation degree of the current system from the normal system, and generating a dynamic trust index based on the deviation degree; A decision module for triggering a zero trust policy decision mechanism when the dynamic trust index exceeds a preset range, and dynamically configuring the resource access permissions and computing task allocation strategy of the server through multi-objective optimization.

Images