Adversarial-based dynamic data leakage protection method, system, device and storage medium

Abstract

The application relates to the technical field of micro-service data leakage protection, and provides a dynamic data leakage protection method, system and device based on generative adversarial and a storage medium, which solves the problems of insufficient generalization ability of new covert tunnel attacks, difficulty in adapting to micro-service dynamic topology and traffic changes, and lack of dynamic optimization mechanism. The application collects network traffic data of communication between micro-services, determines a first and a second communication mode to construct a communication behavior baseline; generates adversarial traffic simulating a covert tunnel attack, compares the real traffic to obtain abnormal traffic information; constructs a dynamic graph, analyzes the instantaneous change of edge weight and the dynamic evolution of community structure to identify suspicious data flow; returns the optimization generative adversarial network parameters, makes a decision based on reinforcement learning, inputs the abnormal features and the dynamic graph analysis result, and outputs the release, alarm and isolation strategy, so that dynamic protection of data leakage is realized, suspicious data flow can be identified and a dynamic output treatment strategy can be output, and accurate dynamic protection of data leakage between micro-services is realized.

Description

Technical Field

[0001] This application relates to the field of microservice data leakage prevention technology, and in particular to a dynamic data leakage prevention method, system, device and storage medium based on generative adversarial methods. Background Technology

[0002] In cloud-native microservice architectures, east-west traffic interactions between services are frequent and the topology changes dynamically. Covert tunneling attacks often disguise themselves as legitimate communication to evade detection, leading to a surge in data leakage risks. This scenario requires protection solutions with core technical requirements such as dynamically adapting to traffic changes, accurately identifying covert attack characteristics, and outputting handling strategies to address the complex and ever-changing data leakage threats in a distributed environment.

[0003] The current mainstream solution for this requirement is an anomaly traffic detection scheme based on traditional machine learning. It extracts traffic statistical features offline, trains a classification model to identify abnormal traffic that deviates from the normal pattern, and then performs protective operations in combination with preset rules, attempting to cover the abnormal communication detection scenario between microservices.

[0004] The existing solution has obvious drawbacks: First, it relies on a large number of labeled samples to train the model, which has weak generalization ability against new types of covert tunnel attacks without labels; second, the extracted static features are difficult to adapt to the dynamic changes in microservice topology and the evolution of traffic patterns, which easily leads to missed detections and false detections; third, it lacks a dynamic feedback optimization mechanism, which cannot adjust the model parameters according to the detection results, making it difficult to cope with the detection failure problem caused by adversarial attacks. Summary of the Invention

[0005] The purpose of this application is to provide a dynamic data leakage protection method, system, device and storage medium based on generative adversarial methods, in order to solve the problems of insufficient generalization ability against new covert tunnel attacks, difficulty in adapting to dynamic topology and traffic changes of microservices, and lack of dynamic optimization mechanisms in the existing technology.

[0006] To address the aforementioned technical problems, in a first aspect, this application provides a dynamic data leakage prevention method based on generative adversarial mechanisms, comprising:

[0007] Collect network traffic data generated during communication between microservices, determine a first communication mode and a second communication mode from the network traffic data, and construct a baseline for communication behavior between microservices based on the determined communication modes;

[0008] Based on the aforementioned communication behavior baseline, a generative adversarial network is used to generate adversarial traffic simulating covert tunnel attacks. By comparing and analyzing the adversarial traffic with the communication traffic of real microservices, abnormal traffic information is obtained.

[0009] By combining the abnormal traffic information with the communication relationships between microservices, a dynamic graph structure is constructed. By analyzing the structural changes in the dynamic graph structure, suspicious data flows that deviate from the communication behavior baseline are identified. The structural changes include changes in weights and changes in community structure.

[0010] The abnormal traffic information and the results of the analysis of the dynamic graph structure are used as the state input of the reinforcement learning model. Based on the state input, the reinforcement learning model outputs a handling strategy, which includes at least one of three operations: allowing passage, alarming, and isolation.

[0011] According to the aforementioned handling strategy, the suspicious data stream will be handled accordingly;

[0012] The features of the suspicious data stream are fed back to the generative adversarial network (GAN) to adjust the parameters of the GAN.

[0013] Optionally, the step of combining the abnormal traffic information with the communication relationships between microservices to construct a dynamic graph structure, and identifying suspicious data flows that deviate from the communication behavior baseline by analyzing structural changes in the dynamic graph structure, includes:

[0014] The abnormal traffic information is combined with the communication relationship between microservices to construct a dynamic graph structure with microservices as nodes and communication relationships as edges. The weight values ​​of each edge in the dynamic graph structure are initially allocated based on the abnormal traffic information of the corresponding communication connection.

[0015] By continuously tracking the changes in the weights of each edge in the dynamic graph structure, calculating the relative rate of change of the edge weights within adjacent time intervals, and identifying communication connections where the edge weights have changed significantly.

[0016] Based on the changes in edge weights, the evolution of the community structure in the dynamic graph is analyzed. By detecting changes in connection density within communities and changes in connection patterns between communities, abnormal behavior patterns of communication groups are identified.

[0017] By combining the significantly changed communication connections and the abnormal behavior patterns of the communication groups, suspicious data flows that deviate from the communication behavior baseline are identified from the data flows between microservices.

[0018] Optionally, the step of identifying abnormal behavior patterns of communication groups by detecting changes in connection density within a community and changes in connection patterns between communities includes:

[0019] Calculate the deviation between the connection density within the community and the historical average density within the current time window. When the deviation exceeds a first threshold, the community is marked as an internal anomalous group.

[0020] Calculate the similarity between the connection patterns between communities within the current time window and the historical patterns. When the similarity is lower than a second threshold, mark the communities involved in the connection as an abnormal interaction group.

[0021] The communication behavior characteristics of the internal abnormal group and the interactive abnormal group are fused to form the abnormal behavior pattern of the communication group. The abnormal behavior pattern of the communication group includes internal connection density abnormal characteristics and cross-community connection abnormal characteristics.

[0022] Optionally, the abnormal traffic information and the result of analyzing the dynamic graph structure are used as the state input of the reinforcement learning model. Based on the state input, the reinforcement learning model outputs a handling strategy, which includes at least one of three operations: allowing passage, issuing an alarm, and isolating.

[0023] The information related to the suspicious data flow in the abnormal traffic information and the information corresponding to the suspicious data flow in the dynamic graph structure analysis results are used as the state input of the reinforcement learning model.

[0024] Based on the state input, a data stream handling strategy is generated through the reinforcement learning decision mechanism. The handling strategy includes determining the corresponding handling action according to the risk level of the suspicious data stream. The handling action includes at least one of three operations: release, alarm, and isolation.

[0025] Optionally, feeding back the features of the suspicious data stream to the generative adversarial network (GAN) to adjust the parameters of the GAN includes:

[0026] Based on the identification results of the suspicious data stream, the communication event sequence pattern, data volume distribution characteristics and time offset characteristics of the suspicious data stream are extracted to form a feedback feature set;

[0027] The feedback feature set is input into the training process of the generative adversarial network, and the network parameters of the generator and discriminator in the generative adversarial network are adjusted based on the feedback feature set to improve the accuracy of the generator in simulating attacks and the sensitivity of the discriminator in identifying anomalies.

[0028] By iteratively executing the input of the feedback feature set and adjusting the network parameters of the generation and discrimination components, the parameters of the generative adversarial network are dynamically optimized to improve the accuracy of abnormal traffic information.

[0029] Optionally, based on the communication behavior baseline, a generative adversarial network is used to generate adversarial traffic simulating a covert tunneling attack. Abnormal traffic information is obtained by comparing and analyzing the adversarial traffic with the real communication traffic of the microservice, including:

[0030] Using the generation component of a generative adversarial network, adversarial traffic simulating covert tunneling attacks is generated based on the communication behavior baseline between the microservices. The adversarial traffic includes abnormal time interval patterns and atypical data volume distributions.

[0031] The discriminant component in the generative adversarial network is used to compare the adversarial traffic with the communication traffic of the real microservice. By calculating the differences between the two in terms of communication event sequence and data volume characteristics, a difference score is generated.

[0032] Based on the difference score, the abnormal part of the communication traffic of the real microservice is located, and the features of the abnormal part that deviate from the communication behavior baseline are extracted to form abnormal traffic information. The abnormal traffic information includes abnormal time offset of communication events, abnormal fluctuation of data volume, and abnormal communication frequency.

[0033] Optionally, the step of collecting network traffic data generated during inter-microservice communication, determining a first communication mode and a second communication mode from the network traffic data, and constructing a baseline for inter-microservice communication behavior based on the determined communication modes includes:

[0034] Continuously collect network traffic data generated during inter-service communication;

[0035] Based on the network traffic data, by analyzing the recurrence pattern of communication events at specific points in time, the communication frequency and period within a fixed time interval are identified to determine the first communication mode.

[0036] Based on the network traffic data, by detecting the changes in the amount of data transmitted by communication events within a continuous time window, the peak data volume and growth trend are identified to determine the second communication mode.

[0037] Based on the first and second communication modes, time-related features and data volume-related features are extracted respectively, and these features are integrated to establish a dynamically adjustable behavior specification for communication between microservice pairs, so as to build a baseline for communication behavior between microservices.

[0038] Secondly, this application provides a dynamic data leakage prevention system based on generative adversarial mechanisms, comprising:

[0039] The acquisition module is used to collect network traffic data generated during communication between microservices, determine a first communication mode and a second communication mode from the network traffic data, and construct a baseline for communication behavior between microservices based on the determined communication mode.

[0040] The analysis module is used to generate adversarial traffic simulating covert tunnel attacks based on the communication behavior baseline using a generative adversarial network. By comparing and analyzing the adversarial traffic with the communication traffic of real microservices, abnormal traffic information is obtained.

[0041] The identification module is used to combine the abnormal traffic information with the communication relationship between microservices to construct a dynamic graph structure. By analyzing the structural changes in the dynamic graph structure, it identifies suspicious data flows that deviate from the communication behavior baseline.

[0042] The output module is used to take the abnormal traffic information and the results of the analysis of the dynamic graph structure as the state input of the reinforcement learning model, and output the handling strategy according to the state input. The handling strategy includes at least one of the three operations of allowing passage, alarming, and isolation.

[0043] The response module is used to perform corresponding processing on the suspicious data stream according to the processing strategy;

[0044] The feedback module is used to feed back the features of the suspicious data stream to the generative adversarial network in order to adjust the parameters of the generative adversarial network.

[0045] Thirdly, this application provides an electronic device, comprising:

[0046] Memory, used to store computer programs;

[0047] A processor, used to implement the steps of the generative adversarial dynamic data leakage prevention method as described in the first aspect above when executing the computer program.

[0048] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, can implement the steps of the generative adversarial dynamic data leakage prevention method described in the first aspect above.

[0049] The beneficial effects of this application are:

[0050] The generative adversarial network (GAN)-based dynamic data leakage protection method provided in this application collects network traffic data between microservices and extracts two types of communication patterns to construct a communication behavior baseline, laying a precise benchmark for anomaly detection. Then, it utilizes a GAN to generate adversarial traffic simulating covert tunnel attacks, comparing it with real traffic to efficiently capture anomaly traffic characteristics without relying on a large number of labeled samples. Subsequently, it constructs a dynamic graph based on microservice communication relationships, and accurately identifies suspicious data flows adapted to dynamic topologies by analyzing changes in edge weights and community structure evolution. Suspicious features are fed back through a feedback loop to optimize GAN parameters, continuously improving the accuracy and generalization ability of anomaly feature representation. Finally, a reinforcement learning decision-making mechanism outputs targeted handling strategies, achieving dynamic, accurate, and efficient protection against data leakage threats between microservices, effectively addressing the detection challenges posed by covert tunnel attacks and dynamic changes in traffic and topology.

[0051] Furthermore, by combining abnormal traffic information with communication relationships between microservices, a dynamic graph structure is constructed with microservices as nodes and communication relationships as edges. Weights are initially assigned to each edge based on abnormal traffic characteristics. By tracking changes in edge weights and calculating the relative rate of change between adjacent time intervals, significantly altered communication connections are identified. Simultaneously, the evolution of community structures in the dynamic graph is analyzed, detecting changes in connection density within communities and connection patterns between communities to identify abnormal group behavior patterns. Finally, combining these two points, suspicious data flows deviating from the communication behavior baseline are identified. This approach adapts to the dynamic changes in microservice topology through a dynamic graph structure, accurately captures single-point communication anomalies by tracking edge weight changes, and identifies abnormal group behavior through community structure evolution analysis. The combination of these two methods achieves comprehensive anomaly monitoring from single points to groups, significantly improving the comprehensiveness and accuracy of suspicious data flow identification and effectively compensating for the limitations of single-dimensional detection. Attached Figure Description

[0052] To more clearly illustrate the technical solutions of the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0053] Figure 1 A flowchart illustrating a dynamic data leakage prevention method based on generative adversarial science provided in this application embodiment;

[0054] Figure 2 A schematic diagram illustrating the specific implementation process of a dynamic data leakage prevention method based on generative adversarial methods provided in this application embodiment;

[0055] Figure 3 This is a schematic diagram of the structure of a dynamic data leakage prevention system based on generative adversarial mechanisms, provided in an embodiment of this application. Detailed Implementation

[0056] In cloud-native microservice architectures, existing abnormal traffic detection solutions based on traditional machine learning have significant limitations: they rely on a large number of labeled samples to train models, which is insufficient for generalizing to new types of unlabeled covert tunnel attacks; the extracted static traffic features are difficult to adapt to the dynamic topology and traffic pattern evolution of microservices, which can easily lead to missed detections and false detections; and they lack dynamic feedback optimization mechanisms, which cannot cope with detection failures caused by adversarial attacks, making it difficult to meet the needs of accurate data leakage protection in complex scenarios.

[0057] To address the aforementioned issues, this application proposes a dynamic data leakage prevention method based on generative adversarial networks (GANs). The core of this method lies in the collaborative operation of communication baseline construction, adversarial traffic generation, dynamic graph analysis, feedback optimization, and reinforcement learning decision-making. Specifically, a communication baseline is first constructed based on traffic patterns. Then, adversarial traffic simulating attacks is generated using a GAN to extract anomaly features. A dynamic graph is constructed based on microservice communication relationships to identify suspicious data flows. Model parameters are optimized through feedback loops, and finally, a handling strategy is output based on reinforcement learning. This method does not rely on a large number of labeled samples. It adapts to microservice topology and traffic changes through dynamic features and feedback mechanisms, fundamentally solving the shortcomings of existing solutions, such as weak generalization ability, poor adaptability, and lack of dynamic optimization, thus achieving precise and dynamic protection against data leakage threats.

[0058] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are merely some embodiments of the present application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0059] The core of this application is to provide a dynamic data leakage prevention method based on generative adversarial science, and a flowchart of one specific implementation is shown below. Figure 1 As shown, the method includes:

[0060] S101. Collect network traffic data generated during communication between microservices, determine a first communication mode and a second communication mode from the network traffic data, and construct a communication behavior baseline between microservices based on the determined communication mode.

[0061] Optionally, step S101 may specifically include the following steps:

[0062] S1011. Continuously collect network traffic data generated during inter-microservice communication.

[0063] Among them, network traffic data is a continuous set of data generated during communication between microservices, including the timestamp of each communication event, i.e. the specific time when the communication occurred, the source service identifier, i.e. the microservice number that initiated the communication, the target service identifier, i.e. the microservice number that received the communication, and the data size, i.e. the amount of data transmitted in a single communication.

[0064] S1012. Based on the network traffic data, by analyzing the recurring patterns of communication events at specific times, the communication frequency and period within a fixed time interval are identified to determine the first communication mode.

[0065] The first communication mode refers to the regular pattern of communication events that recur over time, which is used to reflect the fixed-frequency communication behavior between microservices.

[0066] S1013. Based on the network traffic data, by detecting the changes in the amount of data transmitted by communication events within a continuous time window, the peak value and growth trend of the data volume are identified to determine the second communication mode.

[0067] The second communication mode refers to the mode in which the data volume of a communication event reaches a peak or grows rapidly in a short period of time, which is used to reflect the sudden communication behavior between microservices that is not fixed.

[0068] S1014. Based on the first communication mode and the second communication mode, extract time-related features and data volume-related features respectively, and integrate these features to establish a dynamically adjustable behavior specification for communication between microservice pairs, so as to build a communication behavior baseline between microservices.

[0069] The communication behavior baseline between microservices in the first and second communication modes integrates the periodicity and related features of the second communication modes, and sets dynamic communication behavior specifications for each microservice pair, which serve as a benchmark for judging whether subsequent communication is normal.

[0070] In this embodiment, continuous data acquisition technology is first used to record every communication event that occurs between microservices, ensuring that no communication data is missed. During the acquisition, the timestamp, source service identifier, target service identifier, and data size of each data item are clearly marked.

[0071] For example, if microservice X initiates communication with microservice Y at 14:32:15 and transmits 8MB of data, it will record a complete single traffic data entry such as "14:32:15, X, Y, 8MB". Through continuous accumulation, it forms continuous network traffic data.

[0072] Secondly, the collected network traffic data is filtered, focusing on the communication time information of each microservice pair, and statistical analysis techniques are used to find the recurring patterns of communication events at different times.

[0073] For example, by analyzing all communication times between microservice M and microservice N, it was found that communication occurs once each at 9:00, 15:00, and 21:00 every day, with a stable time interval of 6 hours between the two communications. Thus, the fixed time interval is determined to be 6 hours, the communication frequency is 3 times / day, and the cycle is 24 hours. This leads to the determination of the first communication pattern between microservice M and microservice N, which is a time-dimensional repetitive communication pattern reflected by the combination of fixed time interval, communication frequency, and cycle.

[0074] Next, by setting a reasonable continuous time window, the amount of communication data between microservices within each time window is extracted from the collected network traffic data, and the changes in the amount of data are analyzed through data statistical techniques.

[0075] For example, within a 15-minute window, the amount of communication data between microservice C and microservice D gradually increases from 5MB to 60MB. 60MB is the peak amount of data within this window, and the overall trend shows a rapid upward growth. Based on these characteristics, a second communication pattern between C and D is determined. That is, the second communication pattern is a non-fixed regular communication behavior pattern in which the amount of data between microservices rapidly increases to a peak or shows a clear upward trend within a continuous time window.

[0076] Finally, in step S1014, statistical analysis techniques are used to calculate the average value of the time interval and the range of interval fluctuations, as well as the average duration of each communication, from the first communication mode. Then, from the second communication mode, reasonable upper and lower limits of the data volume peak are calculated to form a threshold range, and the rate of change of the data volume growth trend is calculated. Then, these features extracted from the two modes are integrated, and for each microservice pair with a communication relationship, an allowable floating range is set based on the natural fluctuation of features in its historical communication behavior data. These floating range features of all microservice pairs are summarized to form a communication behavior baseline between services covering both regular and sudden communication features.

[0077] For cloud-native microservice systems, taking the AB and CD communication pairs as an example, the complete process of step S1041 is explained, where AB is the first communication mode and CD is the second communication mode:

[0078] The first step is to process the first communication mode of AB, count the communication data of AB over the past 30 days, calculate the average interval between two communications to be 4 hours, the interval naturally fluctuates between 3 hours and 40 minutes and 4 hours and 20 minutes, so take the fluctuation range of ±20 minutes; the average duration of each communication is 5 minutes.

[0079] The second step is to process the second communication mode of CD, and statistically analyze the data during multiple business peak periods. The average peak data volume within the time window is 60MB, with natural fluctuations between 50MB and 70MB. Therefore, the peak threshold range is set to 60MB ± 10MB. The rate of change of the data volume from the initial growth to the peak is calculated to be 8MB per minute.

[0080] The third step is to set a floating range for each microservice pair. The communication interval of AB is allowed to fluctuate between 3 hours and 40 minutes and 4 hours and 20 minutes, with a duration of 5 minutes and a tolerance of ±1 minute. The peak threshold range of CD is kept at 60MB ± 10MB, with a growth trend change rate of 8MB / minute and a tolerance of ±1MB / minute.

[0081] The fourth step is to summarize all the floating range characteristics of AB, CD, and other microservice pairs within the system and organize them in Table 1 as the baseline for communication behavior between services in the entire system. Subsequent communication between each microservice pair must conform to its corresponding floating range characteristics, as shown in Table 1 below:

[0082] Table 1: Baseline of Inter-Service Communication Behavior

[0083]

[0084] S102. Based on the communication behavior baseline, a generative adversarial network is used to generate adversarial traffic that simulates a covert tunnel attack. By comparing and analyzing the adversarial traffic with the communication traffic of the real microservice, abnormal traffic information is obtained.

[0085] Generative Adversarial Networks (GANs) are technical models that include a generation component and a discrimination component. The generation component is used to simulate attack scenarios and generate specific traffic, while the discrimination component is used to compare different traffic and determine the differences.

[0086] Optionally, step S102 may specifically include the following steps:

[0087] S1021. Using the generation component of a generative adversarial network, generate adversarial traffic simulating a covert tunnel attack based on the communication behavior baseline between the microservices. The adversarial traffic includes abnormal time interval patterns and atypical data volume distributions.

[0088] Among them, adversarial traffic is fake traffic that simulates covert tunnel attacks. It includes abnormal time interval patterns and atypical data volume distribution, which are inconsistent with the baseline time pattern and the baseline data volume variation.

[0089] S1022. Using the discriminant component in the generative adversarial network, the adversarial traffic is compared with the communication traffic of the real microservice. By calculating the differences between the two in terms of communication event sequence and data volume characteristics, a difference score is generated.

[0090] In this context, real microservice communication traffic refers to the traffic generated by actual communication between microservices. The difference score is a numerical value that measures the degree of difference between adversarial traffic and real traffic in key characteristics.

[0091] S1023. Based on the difference score, locate the abnormal part in the communication traffic of the real microservice, and extract the features of the abnormal part that deviate from the communication behavior baseline to form abnormal traffic information. The abnormal traffic information includes abnormal time offset of communication events, abnormal fluctuation of data volume, and abnormal communication frequency.

[0092] Among them, the abnormal traffic information of real microservice communication traffic is a set of features that deviate from the baseline extracted from real traffic, including abnormal time offset of communication events, abnormal fluctuation of data volume, and abnormal communication frequency, which are used to identify traffic features that may be attacked.

[0093] In this embodiment, step S1021 clarifies that the core task of the adversarial network generation component is to simulate covert tunnel attacks. Using the communication behavior baseline as a reference, adversarial traffic is generated by simulating the interference of attacks on normal communication. Specifically, the generation component first learns the normal time intervals and data volume distribution patterns between microservices in the baseline, and then deliberately breaks these patterns. For example, if the baseline for a certain microservice pair is that they communicate at fixed time intervals at 9:00, 15:00, and 21:00 every day, with a typical data volume distribution of 10-18MB, to break the original fixed-time communication pattern, the generation component can, for example, communicate at 7:00, 10:00, 13:00, and 16:00 every day, and control the data volume to fluctuate irregularly between 3MB, 45MB, 12MB, and 50MB. This generates adversarial traffic with no fixed time intervals and irregular data volume fluctuations. This adversarial traffic can accurately simulate the camouflage characteristics of covert tunnel attacks.

[0094] Secondly, by calling the discrimination component of the generative adversarial network in step S1022, the generated adversarial traffic is compared with the real communication traffic between microservices, and then the comparison is carried out from two core dimensions:

[0095] First, compare the communication event sequence, comparing the time order of the two communications and whether the interval between the two communications is consistent. For example, real traffic communicates once every 3 hours, while adversarial traffic communicates once every 1 hour, and there is a difference in the time interval between the two.

[0096] Second, the data volume characteristics are compared to see if the data volume of a single communication and the overall data volume trend are consistent. For example, the real traffic data volume is stable at 10-20MB, while the combat traffic data volume fluctuates between 5-50MB, indicating a difference in the data volume distribution between the two.

[0097] Next, the difference score is calculated using the following formula:

[0098]

[0099] Among them, the time interval difference value is the difference between the two time intervals normalized to a value of 0-10, and the data volume distribution difference value is the difference between the two data volume fluctuation ranges normalized to a value of 0-10.

[0100] For example, if the time interval between real traffic and adversarial traffic is 2 hours, assuming a normalization value of 8, and the data volume fluctuation range is 40MB, assuming a normalization value of 9, then... This allows us to quantify the degree of difference between the two.

[0101] Finally, a reasonable difference score threshold, such as 6 points, is set in step S1023. The difference score calculated in step S1022 is compared with this threshold. If the difference score corresponding to a certain portion of real traffic is higher than the threshold, this portion of traffic is identified as an abnormal part that deviates from the baseline of communication behavior between microservices. These abnormal parts are then analyzed in depth to extract the specific characteristics of deviation from the baseline. The specific operations are as follows:

[0102] If the communication time of the abnormal part is earlier or later than the baseline, it forms an abnormal time offset feature of the communication event. For example, if the baseline is communication at 9 o'clock every day and the abnormal part is communication at 7 o'clock every day, then the communication time being 2 hours earlier is extracted as the abnormal time offset feature.

[0103] If the amount of data in the abnormal part suddenly increases or decreases significantly, exceeding the normal range of the baseline, it forms a data volume abnormal fluctuation feature. For example, if the baseline data volume is 20-30MB and the abnormal part data volume reaches 60MB, then the abnormal increase in data volume to 60MB is extracted as a data volume abnormal fluctuation feature.

[0104] If the number of communications in the abnormal segment is more or less than the baseline, it forms a communication frequency anomaly feature. For example, if the baseline communicates 3 times a day and the abnormal segment communicates 8 times a day, then the communication frequency of the abnormal segment is increased to 8 times a day as a communication frequency anomaly feature. Finally, these features are integrated to form abnormal traffic information.

[0105] This application can efficiently extract multi-dimensional abnormal features such as time, data volume, and frequency from real traffic, providing accurate core feature support for subsequent dynamic graph construction and suspicious data stream identification.

[0106] S103. Combine the abnormal traffic information with the communication relationship between microservices to construct a dynamic graph structure. By analyzing the structural changes in the dynamic graph structure, identify suspicious data flows that deviate from the communication behavior baseline. The structural changes include changes in weights and changes in community structure.

[0107] The communication relationship between microservices refers to whether communication exists between different microservices and the frequency of such communication. A dynamic graph structure is a graphical structure with microservices as nodes, communication relationships between microservices as edges, and edge weights that change with the communication state.

[0108] Optionally, step S103 may specifically include the following steps:

[0109] S1031. Combine the abnormal traffic information with the communication relationship between microservices to construct a dynamic graph structure with microservices as nodes and communication relationships as edges. The weight values ​​of each edge in the dynamic graph structure are initially allocated according to the abnormal traffic information of the corresponding communication connection.

[0110] S1032. By continuously tracking the changes in the weights of each edge in the dynamic graph structure, the relative rate of change of the edge weights within adjacent time intervals is calculated, and communication connections where the edge weights have changed significantly are identified.

[0111] The relative rate of change is the ratio of the change in edge weights within adjacent time intervals to the original weights, used to measure the drastic nature of weight changes. The community structure is a cluster of microservice nodes with tight internal connections in a dynamic graph.

[0112] S1033. Based on the changes in the edge weights, analyze the evolution of the community structure in the dynamic graph structure, and identify abnormal behavior patterns of the communication group by detecting changes in the connection density within the community and changes in the connection patterns between communities.

[0113] Specifically, step S1033 includes the following processes: calculating the deviation between the intra-community connection density and the historical average density within the current time window; when the deviation exceeds a first threshold, the community is marked as an internal anomalous group; calculating the similarity between the inter-community connection patterns and historical patterns within the current time window; when the similarity is lower than a second threshold, the communities involved in the connections are marked as an interaction anomalous group; and fusing the communication behavior characteristics of the internal anomalous group and the interaction anomalous group to form an anomalous behavior pattern of the communication group, wherein the anomalous behavior pattern of the communication group includes internal connection density anomalous characteristics and cross-community connection anomalous characteristics.

[0114] S1034. Combining the significantly changed communication connections and the abnormal behavior patterns of the communication groups, identify suspicious data flows that deviate from the communication behavior baseline from the data flows between microservices.

[0115] like Figure 2 As shown in this embodiment, the abnormal traffic information obtained in step S102 is first combined with the communication relationship between microservices in step S1031 to construct a dynamic graph structure. The specific operation is as follows:

[0116] The first step is to determine which microservices communicate with each other, and then construct the nodes and edges of the graph based on this, that is, each microservice corresponds to an independent node.

[0117] The second step is to add an edge if two microservices communicate with each other, and associate the previously obtained abnormal traffic information with each edge. Assign an initial weight to the edge according to the degree of abnormality of the feature. The higher the degree of abnormality, the larger the weight value. For example, if the communication between microservices A and B has the feature of "abnormal fluctuation in data volume", the edge weight is set to 6. If the communication between microservices C and D has no abnormal features, the edge weight is set to 1.

[0118] Secondly, in step S1032, a fixed time interval is set as the weight tracking period, such as 15 minutes. In each period, the current weight value of all edges in the dynamic graph is obtained and compared with the weight value of the previous period. The relative change rate of the weight of each edge is calculated using the following formula:

[0119]

[0120] For example, if the weight of a certain side was 5 in the previous cycle and the weight is 9 in the current cycle, substituting it into the formula yields... Then set a reasonable rate of change threshold (e.g., 40%), compare the calculated relative rate of change with this threshold, and if the rate of change of a certain side exceeds the threshold, for example, the relative rate of change mentioned above is 80%, which is greater than the rate of change threshold of 40%, then the communication connection corresponding to that side is identified as a communication connection whose edge weight has changed significantly.

[0121] Next, a time window, such as 20 minutes, is set in step S1033 to analyze the evolution of the community structure in the dynamic graph based on changes in edge weights. This analysis process consists of two steps:

[0122] The first step is to calculate the deviation of the connection density within the community: First, count the number of nodes N in the community within the current window, and the maximum possible number of edges is... Next, count the actual number of edges M within the community to calculate the current density. The calculation formula is as follows: Calculate the historical average density over the past 10 windows and substitute it into the formula: If the deviation exceeds the first threshold (e.g., 0.3), it is marked as an internal abnormal group. For example, a community has 5 nodes, a maximum number of edges of 10, a current actual number of edges of 8, a density of 0.8, a historical average of 0.5, and a calculated deviation of 0.6. The first threshold is set to 0.3. If the deviation is greater than the first threshold, it is marked as an internal abnormal group.

[0123] The second step is to calculate the similarity of connection patterns between communities: The communication edge weights between the current community and other communities are used to form the current pattern vector, and the historical pattern vector is composed of the average weights of the past 10 windows. These are then substituted into the cosine similarity formula: If the similarity is lower than the second threshold, it is marked as an abnormal interaction group. For example, if the current vector is (3,5,2) and the historical vector is (6,4,3), the calculated similarity is 0.91, and the second threshold is set to 0.6. In this case, the similarity is greater than the second threshold, so it is not marked. However, if the current vector is (1,2,8), the calculated similarity is 0.58, which is less than the second threshold of 0.6, so it is marked as an abnormal interaction group.

[0124] After the analysis, the characteristics of internal and interactive abnormal groups were integrated to form an abnormal behavior pattern of communication groups that includes abnormal internal connection density and abnormal cross-community connection.

[0125] Finally, step S1034 organizes the list of communication connections that have undergone significant changes identified in step S1032, and analyzes the abnormal behavior patterns of communication groups obtained in step S1033 (such as abnormal density within a community or abnormal interaction between two communities). All data streams between microservices are then filtered to determine whether each data stream simultaneously meets two conditions:

[0126] First, the communication connection corresponding to the data stream belongs to a list of connections that change significantly. For example, if the data stream is transmitted between A and B, then it corresponds to the A and B sides.

[0127] Second, the microservice node to which the data stream belongs belongs to a communication group with abnormal behavior patterns, such as A and B belonging to a community with abnormal internal density.

[0128] If a data stream meets both of these conditions and its communication characteristics (time, data volume, etc.) deviate from the baseline of communication behavior between microservices, it is identified as a suspicious data stream. For example, if edge A and B are significantly changed connections, A and B belong to an internal anomalous group, and the data stream between A and B has the characteristic of "data volume exceeding the baseline by 2 times", then this data stream is a suspicious data stream.

[0129] Specifically, in a cloud-native microservice system, microservices A, B, C, D, and E are treated as nodes. Connection edges are established based on communication relationships, and initial weights are assigned to each edge based on abnormal traffic characteristics: AB: 7, BC: 2, CD: 1, DE: 6, AE: 1. Weight changes are tracked every 10 minutes. It is found that edge AB changes from 7 to 15, a relative change rate of 114%, exceeding the threshold by 50%, while edge DE changes from 6 to 10, a change rate of 67%, exceeding the threshold. When analyzing the community structure, the connection density within the community composed of A, B, and E within the current 30 minutes is calculated to be 0.8, compared to a historical average of 0.5, with a deviation of 0.6, exceeding the first threshold of 0.3, thus marking it as an internal abnormal group. The connection pattern similarity between this community and the community composed of C and D is 0.4, below the second threshold of 0.6, thus marking it as an interaction abnormal group. Combining the significant changes in connections between AB and DE and the two types of abnormal groups, high-frequency, high-volume communication between AB and the bursty communication between DE are identified as suspicious data flows. The above example is only one illustration; in practical applications, it can be configured according to requirements.

[0130] This application visualizes abstract traffic characteristics and communication relationships by constructing a dynamic graph structure. Edge weight change tracking can accurately capture single-point communication anomalies, and community structure evolution analysis can identify group communication anomalies. The combination of the two realizes multi-dimensional anomaly monitoring from individuals to groups, which greatly improves the comprehensiveness and accuracy of suspicious data flow identification, effectively avoids the problem of missed detection in single-dimensional detection, and provides accurate target basis for the formulation of subsequent protection strategies.

[0131] S104. The abnormal traffic information and the result of analyzing the dynamic graph structure are used as the state input of the reinforcement learning model. Based on the state input, the reinforcement learning model outputs a handling strategy, which includes at least one of three operations: allowing passage, alarming, and isolation.

[0132] Optionally, step S104 may specifically include the following steps:

[0133] S1041. Use the information related to the suspicious data flow in the abnormal traffic information and the information corresponding to the suspicious data flow in the dynamic graph structure analysis results as the state input of the reinforcement learning model.

[0134] Reinforcement learning decision-making is an intelligent mechanism that optimizes decision-making behavior through continuous learning and adjustment. State input is the set of information used for decision-making in reinforcement learning, including abnormal traffic characteristics and dynamic graph analysis results.

[0135] S1042. Based on the state input, a data stream handling strategy is generated through the reinforcement learning decision mechanism. The handling strategy includes determining the corresponding handling action according to the risk level of the suspicious data stream. The handling action includes at least one of three operations: release, alarm, and isolation.

[0136] The handling strategy is the action plan for dealing with suspicious data streams, including at least one of three operations: allowing, alerting, and isolating. These three operations correspond to allowing data stream transmission, alerting management personnel, and blocking data stream transmission, respectively.

[0137] In this embodiment, information related to suspicious data flows is first extracted from the acquired abnormal traffic information. For example, for suspicious data flows between microservices X and Y, the corresponding abnormal traffic information is extracted as time offset of 1 hour + frequency of 5 minutes / time + data volume of 10-90MB. At the same time, information on the corresponding suspicious data flows in the dynamic graph structure analysis results is obtained, such as X and Y belonging to communities with abnormal internal connection density. Finally, these two parts of information are integrated into a unified state input, for example, suspicious data flow XY: frequency of 5 minutes / time + data volume of 10-90MB + time offset of 1 hour + abnormal internal density of the community, which serves as the basic information for the reinforcement learning model to make decisions.

[0138] Secondly, in step S1052, the "status input" is input into the reinforcement learning decision-making mechanism. The risk level is determined based on the number and severity of abnormal features in the status input: if there is only one abnormality in the status input, it is judged as low risk; if there are 2-3 abnormalities, it is judged as medium risk; if there are more than 3 abnormalities, it is judged as high risk. Then, a corresponding handling action is generated according to the risk level, including at least one of the three operations: allow, alarm, and isolation. The correspondence is as follows: low risk corresponds to allow, meaning no interference with normal communication; medium risk corresponds to alarm, immediately notifying management personnel to check; high risk corresponds to isolation, immediately stopping transmission to prevent leakage, thus forming a complete data flow handling strategy.

[0139] This application integrates abnormal traffic information related to suspicious data streams with dynamic graph analysis results as state inputs, and generates strategies containing at least one handling action according to risk level by a reinforcement learning decision-making mechanism, thereby achieving accuracy and flexibility in handling suspicious data streams.

[0140] S105. Perform corresponding processing on the suspicious data stream according to the processing strategy.

[0141] In this embodiment, the handling strategies and specific execution procedures corresponding to different risk levels are first clarified, and then the processing is carried out according to the strategies. The specific operations are as follows:

[0142] For data streams that the reinforcement learning decision-making mechanism determines to be high-risk, isolation operations are performed. Specifically, this involves cutting off the inter-service communication links corresponding to the data stream and restricting its network transmission permissions to directly prevent the data stream from continuing to be transmitted and avoid potential data leakage and spread.

[0143] For data streams identified as medium-risk, an alarm operation is executed, specifically and automatically generating an alarm notification containing key information such as the source service, target service, and abnormal characteristics of the suspicious data stream. This notification is then sent to administrators via email, SMS, or platform pop-ups to remind them to intervene and investigate in a timely manner.

[0144] For data streams deemed low-risk, a release operation is performed, specifically allowing the data streams to transmit normally, but a real-time monitoring mode is activated to continuously track their communication status and data changes.

[0145] The results of each response strategy were then collected:

[0146] If a security audit confirms that the data stream contained sensitive data leaks after isolation, it indicates that the high-risk handling strategy was correct.

[0147] If, after receiving an alarm, the administrators find that the abnormal data flow was due to a temporary business adjustment that resulted in normal communication, it indicates a deviation in the decision-making process for handling medium-risk situations.

[0148] If the data stream does not trigger any data breaches during the monitoring period after being allowed to pass, it indicates that the low-risk handling strategy decision was correct.

[0149] Finally, the decision rules of the reinforcement learning decision-making mechanism are updated based on the execution results. For correct decisions, the correlation weight between the state input and the "isolation" action is strengthened; for decisions with deviations, the correlation between the state input and the "alarm" action is weakened, or its risk level judgment standard is lowered, such as from medium risk to low risk, in order to improve the accuracy of subsequent decisions.

[0150] S106. Feed back the features of the suspicious data stream to the generative adversarial network to adjust the parameters of the generative adversarial network.

[0151] Optionally, step S106 may specifically include the following steps:

[0152] S1061. Based on the identification results of the suspicious data stream, extract the communication event sequence pattern, data volume distribution characteristics and time offset characteristics of the suspicious data stream to form a feedback feature set.

[0153] S1062. The feedback feature set is input into the training process of the generative adversarial network, and the network parameters of the generator and discriminator in the generative adversarial network are adjusted based on the feedback feature set to improve the accuracy of the generator in simulating attacks and the sensitivity of the discriminator in identifying anomalies.

[0154] The generative adversarial network training process is a learning process that optimizes the model's generation and discrimination capabilities.

[0155] S1063. By iteratively executing the input of the feedback feature set and adjusting the network parameters of the generation and discrimination components, the parameters of the generative adversarial network are dynamically optimized to improve the accuracy of abnormal traffic information.

[0156] In this embodiment of the application, firstly, three core features—communication event sequence pattern, data volume distribution characteristics, and time offset characteristics—are extracted from the suspicious data stream through step S1061, and then the data stream information in the identification results is analyzed one by one.

[0157] For example, when extracting communication event sequence patterns, the occurrence time of each communication in a suspicious data stream is statistically analyzed to sort out its time sequence and the interval between adjacent communications. For example, a suspicious data stream has 4 communications at 10:00, 10:08, 10:16, and 10:24, with the time sequence increasing and the interval between adjacent communications being 8 minutes.

[0158] For example, when extracting the data volume distribution characteristics, record the data volume of each communication in the suspicious data stream, and summarize its variation range and overall distribution. For example, the data volume of each communication in this data stream is 10MB, 50MB, 20MB and 70MB respectively, with a variation range of 10-70MB, and the overall distribution is irregular.

[0159] For example, when extracting time offset features, the communication time of the suspicious data stream is compared with the time of the baseline communication behavior between microservices to calculate the deviation duration. For example, if the baseline suggests that this type of communication should start at 14:00, but the suspicious data stream starts at 12:30, which is 1.5 hours earlier, then the deviation duration is 1.5 hours.

[0160] Finally, these three types of features are grouped together to form a feedback feature set.

[0161] Secondly, in step S1062, the feedback feature set is input into the training stage of the generative adversarial network (GAN), allowing the model to learn these features from real-world suspicious data streams. Precise and guided parameter fine-tuning is then performed on the generator and discriminator of the GAN to optimize the model's capabilities. This optimization process is detailed below:

[0162] The generator no longer simply learns from a general baseline of normal traffic, but instead mimics specific types of real attack behavior, generating more deceptive and diverse adversarial examples. The generator's network parameters are updated using a backpropagation algorithm. Specifically, the backpropagation algorithm optimizes its loss function by adding a match between the loss function and the feedback feature set as an optimization objective. For example, if the feedback feature set indicates that current attacks are characterized by "irregular fluctuations in data volume between 5-80MB," the backpropagation algorithm adjusts the generator's network parameters to ensure that the output adversarial traffic more likely covers this range in terms of data volume distribution, while introducing corresponding randomness to simulate irregular characteristics. Essentially, this allows the generator to focus on the most active attack patterns, thereby generating more targeted negative samples to enhance the discriminator's capabilities.

[0163] For the discriminator component, the goal is to improve the discriminator's alertness to subtle and emerging anomalies and its classification accuracy, while reducing false positives and false negatives. The discriminator's network parameters are also updated using a backpropagation algorithm. During training, feedback feature sets with suspicious labels are given higher weights, forcing the discriminator to pay more attention to these samples. Specifically, the discriminator's decision boundary is recalibrated. For example, when the feature "time offset 1.5 hours" frequently appears in the feedback feature set, the training process adjusts the sensitivity of the discriminator's network parameters so that significant anomalous activation values ​​are generated even when the time offset is below a historical threshold. This effectively lowers the discriminator's alertness threshold for this type of feature, enabling it to identify traffic carrying such emerging threat characteristics more quickly and accurately.

[0164] Finally, the above-mentioned feedback feature input and parameter adjustment process is iteratively executed through step S1063. For example, an iteration is performed every 10 new suspicious data streams identified: the first iteration inputs the feedback feature set of the first batch of 10 suspicious data streams into the training, and after adjusting the parameters, the simulation and discrimination capabilities of the generative adversarial network are initially improved; the second iteration inputs the feedback feature set of the newly identified 10 suspicious data streams into the training, and further adjusts the parameters so that the model can adapt to these new features; after multiple iterations, the parameters of the generative adversarial network will be continuously and dynamically optimized, and the abnormal traffic information output by the model will also be updated accordingly, gradually expanding from initially only accurately reflecting a few attack features to being able to accurately correspond to various actual threat features appearing in the system.

[0165] This application establishes a feedback link to transmit the actually identified suspicious features back to the model training, realizing the dynamic adjustment of generative adversarial network parameters. This enables the model to continuously learn new attack threat features, which not only improves the realism of the generated components' simulated attacks and the sensitivity of identifying anomalies in the components, but also continuously improves the matching degree between abnormal traffic information and actual threats, avoiding the limitation that the model cannot cope with new attacks due to fixed parameters.

[0166] Figure 3 This is a schematic diagram illustrating a specific implementation of a dynamic data leakage prevention system based on generative adversarial mechanisms, as provided in this application. (Refer to...) Figure 3 The system may include:

[0167] The acquisition module 31 is used to acquire network traffic data generated during communication between microservices, determine a first communication mode and a second communication mode from the network traffic data, and construct a communication behavior baseline between microservices based on the determined communication mode.

[0168] Analysis module 32 is used to generate adversarial traffic simulating covert tunnel attacks based on the communication behavior baseline using a generative adversarial network, and obtain abnormal traffic information by comparing and analyzing the adversarial traffic with the communication traffic of real microservices.

[0169] The identification module 33 is used to combine the abnormal traffic information with the communication relationship between microservices to construct a dynamic graph structure, and to identify suspicious data streams that deviate from the communication behavior baseline by analyzing the structural changes in the dynamic graph structure.

[0170] Output module 34 is used to take the abnormal traffic information and the result of analyzing the dynamic graph structure as the state input of the reinforcement learning model, and output a handling strategy based on the state input. The handling strategy includes at least one of three operations: allowing passage, alarming, and isolation.

[0171] The response module 35 is used to perform corresponding processing on the suspicious data stream according to the processing strategy;

[0172] Feedback module 36 is used to feed back the features of the suspicious data stream to the generative adversarial network in order to adjust the parameters of the generative adversarial network.

[0173] The generative adversarial dynamic data leakage prevention system of this application embodiment is used to implement the aforementioned generative adversarial dynamic data leakage prevention method. Therefore, the specific implementation of the generative adversarial dynamic data leakage prevention system can be found in the embodiment section of the generative adversarial dynamic data leakage prevention method above. The specific implementation can be referred to the description of the corresponding embodiments, which will not be repeated here.

[0174] This application also provides an electronic device, comprising: a memory for storing a computer program; and a processor for executing the computer program to implement the steps of any of the above-described generative adversarial dynamic data leakage prevention methods.

[0175] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of any of the above-described generative adversarial dynamic data leakage prevention methods.

[0176] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as USB flash drives, read-only memory, random access memory, portable hard drives, magnetic disks, or optical disks.

[0177] Embodiments of the present invention also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the embodiments of the generative adversarial dynamic data leakage prevention method described above.

[0178] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0179] The foregoing has provided a detailed description of a generative adversarial dynamic data leakage prevention method, system, device, and storage medium provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are merely for the purpose of helping to understand the method and its core ideas. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of this application.

Claims

1. A dynamic data leak protection method based on generative adversarial, characterized in that, The method comprises the following steps: Collecting network traffic data generated in the communication process between microservices, determining a first communication mode and a second communication mode from the network traffic data, and constructing a communication behavior baseline between microservices based on the determined communication mode; Based on the communication behavior baseline, an adversarial traffic simulating a covert tunnel attack is generated by using a generative adversarial network, and abnormal traffic information is obtained by comparing and analyzing the adversarial traffic with the communication traffic of real microservices; Combine the abnormal traffic information with the communication relationship between microservices to construct a dynamic graph structure, and identify suspicious data flow deviating from the communication behavior baseline by analyzing the structural changes in the dynamic graph structure, including changes in weights and community structure; The abnormal traffic information and the result of analyzing the dynamic graph structure are input as the state of a reinforcement learning model, and a disposal strategy is output from the reinforcement learning model according to the state input, the disposal strategy including at least one of the three operations of release, alarm and isolation; According to the disposal strategy, the corresponding disposal is performed on the suspicious data flow; The characteristics of the suspicious data flow are fed back to the generative adversarial network to adjust the parameters of the generative adversarial network; The method comprises the following steps: Using the generation component of the generative adversarial network to generate adversarial traffic simulating a covert tunnel attack according to the communication behavior baseline between microservices, the adversarial traffic containing abnormal time interval mode and atypical data volume distribution; Using the discriminant component in the generative adversarial network to compare the adversarial traffic with the communication traffic of real microservices, and generating a difference score by calculating the difference between the two in communication event sequence and data volume characteristics; Based on the difference score, locate the abnormal part in the communication traffic of the real microservices, and extract the features deviating from the communication behavior baseline in the abnormal part to form abnormal traffic information, including abnormal time offset of communication events, data volume abnormal fluctuation and communication frequency abnormality.

2. The generative adversarial based dynamic data leak protection method of claim 1, wherein, The method comprises the following steps: Combine the abnormal traffic information with the communication relationship between microservices to construct a dynamic graph structure, and identify suspicious data flow deviating from the communication behavior baseline by analyzing the structural changes in the dynamic graph structure, including: Combine the abnormal traffic information with the communication relationship between microservices to construct a dynamic graph structure with microservices as nodes and communication relationship as edges, and the weight values of each edge in the dynamic graph structure are initially allocated according to the abnormal traffic information of the corresponding communication connection; By continuously tracking the changes of the weight of each edge in the dynamic graph structure, calculate the relative change rate of the edge weight in the adjacent time interval, and identify the communication connection with significant changes in edge weight. Based on the change of the edge weight, the evolution process of the community structure in the dynamic graph structure is analyzed, and the abnormal behavior mode of the communication group is identified by detecting the change of the connection density within the community and the change of the connection mode between communities; In combination with the significantly changed communication connection and the abnormal behavior mode of the communication group, a suspicious data flow deviating from the communication behavior baseline is identified from the data flow between microservices.

3. The generative adversarial based dynamic data leak protection method of claim 2, wherein, The abnormal behavior mode of the communication group is identified by detecting the change of the connection density within the community and the change of the connection mode between communities, including: Calculate the deviation of the connection density within the community in the current time window from the historical average density, and mark the community as an internal abnormal group when the deviation exceeds a first threshold; Calculate the similarity of the connection mode between communities in the current time window to the historical mode, and mark the community involved in the connection as an interaction abnormal group when the similarity is lower than a second threshold; Fuse the communication behavior characteristics of the internal abnormal group and the interaction abnormal group to form the abnormal behavior mode of the communication group, which includes internal connection density abnormal characteristics and cross-community connection abnormal characteristics.

4. The generative adversarial based dynamic data leak protection method of claim 1, wherein, The abnormal traffic information and the result of analyzing the dynamic graph structure are input as state inputs of a reinforcement learning model, and a treatment strategy is output from the reinforcement learning model according to the state inputs, the treatment strategy including at least one of the three operations of release, alarm and isolation, including: The information related to the suspicious data flow in the abnormal traffic information and the information corresponding to the suspicious data flow in the dynamic graph structure analysis result are input as state inputs of a reinforcement learning model; Based on the state input, a data flow treatment strategy is generated by the reinforcement learning model, which includes determining the corresponding treatment action according to the risk level of the suspicious data flow, and the treatment action includes at least one of the three operations of release, alarm and isolation.

5. The generative adversarial-based dynamic data leak protection method of claim 1, wherein, The feature of the suspicious data flow is fed back to the generative adversarial network to adjust the parameters of the generative adversarial network, including: Based on the identification result of the suspicious data flow, the communication event sequence mode, data volume distribution feature and time offset feature of the suspicious data flow are extracted to form a feedback feature set; The feedback feature set is input into the training process of the generative adversarial network, and the network parameters of the generation component and the discrimination component in the generative adversarial network are adjusted based on the feedback feature set to improve the accuracy of the generation component simulation attack and the sensitivity of the discrimination component identification of abnormalities; Through iterative execution of the input of the feedback feature set and the adjustment of the network parameters of the generation component and the discrimination component, the parameters of the generative adversarial network are dynamically optimized to optimize the accuracy of the abnormal traffic information.

6. The generative adversarial-based dynamic data leak protection method of claim 1, wherein, The network traffic data generated in the communication process between microservices is collected, the first communication mode and the second communication mode are determined from the network traffic data, and the communication behavior baseline between microservices is constructed based on the determined communication mode, including: Continuous collection of network traffic data generated during communication between microservices; Based on the network traffic data, by analyzing the regularity of the repeated occurrence of communication events at a time point, the communication frequency and period within a fixed time interval are identified to determine the first communication mode; Based on the network traffic data, by detecting the transmission data volume changes of communication events within a continuous time window, the data volume peak and growth trend are identified to determine the second communication mode; Based on the first communication mode and the second communication mode, time-related features and data volume-related features are extracted respectively, and these features are integrated to establish a dynamically adjustable behavior specification for communication between microservices, to build a communication behavior baseline between microservices.

7. A dynamic data leak protection system based on generative adversarial, characterized in that, Comprise: The acquisition module is used for collecting network traffic data generated in the communication process between microservices, determining the first communication mode and the second communication mode from the network traffic data, and building a communication behavior baseline between microservices based on the determined communication mode; The analysis module is used for generating adversarial traffic simulating covert tunnel attacks based on the communication behavior baseline using a generative adversarial network, and obtaining abnormal traffic information by comparing and analyzing the adversarial traffic with real microservice communication traffic; The analysis module is used for generating adversarial traffic simulating covert tunnel attacks based on the communication behavior baseline using a generative adversarial network, and obtaining abnormal traffic information by comparing and analyzing the adversarial traffic with real microservice communication traffic, comprising: The generation component of the generative adversarial network generates adversarial traffic simulating covert tunnel attacks according to the communication behavior baseline between microservices, and the adversarial traffic contains abnormal time interval mode and atypical data volume distribution; The discriminant component in the generative adversarial network compares the adversarial traffic with real microservice communication traffic, calculates the difference between the two in communication event sequence and data volume characteristics, and generates a difference score; Based on the difference score, the abnormal part in the real microservice communication traffic is located, and the features deviating from the communication behavior baseline in the abnormal part are extracted to form abnormal traffic information, which includes abnormal time offset of communication events, data volume abnormal fluctuation and communication frequency abnormality; The identification module is used for combining the abnormal traffic information with the communication relationship between microservices to build a dynamic graph structure, and identifying suspicious data flow deviating from the communication behavior baseline by analyzing the structural changes in the dynamic graph structure; The output module is used for inputting the abnormal traffic information and the results of analyzing the dynamic graph structure as the state input of the reinforcement learning model, and outputting the handling strategy from the reinforcement learning model according to the state input, wherein the handling strategy includes at least one of the three operations of release, alarm and isolation; The response module is used for executing corresponding handling on the suspicious data flow according to the handling strategy; The feedback module is used for feeding back the features of the suspicious data flow to the generative adversarial network to adjust the parameters of the generative adversarial network.

8. An electronic device, comprising: Comprise: Memory for storing computer programs; A processor for implementing the steps of the method for dynamic data breach protection based on generative adversarial when the computer program is executed.

9. A computer-readable storage medium, characterized in that, A computer readable storage medium having stored therein a computer program capable of implementing the method for dynamic data breach protection based on generative adversarial when executed by a processor.

Images