Server security defense method and device, electronic equipment and readable storage medium

Abstract

The invention discloses a server security defense method and device, electronic equipment and a readable storage medium. The method comprises the steps of obtaining monitoring data of at least one monitoring node of a server and constructing the monitoring data into a graph data structure; wherein the nodes of the graph data structure are the monitoring nodes, and the weights of the edges of the graph data structure are determined based on the monitoring data; determining a first global state of the monitoring node based on the monitoring data of the monitoring node and the weight of the edge associated with the monitoring node in the graph data structure; and determining a security defense strategy based on the first global state of the monitoring node, and performing security defense on the area where the monitoring node is located based on the security defense strategy.

Description

Technical Field

[0001] This application belongs to the field of network security technology, specifically relating to a server security defense method, device, electronic device, and readable storage medium. Background Technology

[0002] In related technologies, server security typically relies on centralized intrusion detection systems (IDS) and intrusion prevention systems (IPS). These systems identify and block cybersecurity threats based on static rule bases and identify known attacks through predefined signatures or anomaly detection models. However, the individual security devices or systems within these systems usually operate independently, lacking effective coordination mechanisms, thus limiting the coverage and capabilities of defense strategies. Summary of the Invention

[0003] The purpose of this application is to provide a server security defense method, device, electronic device, and readable storage medium, which can solve the problem that various security devices or systems usually work independently and lack an effective coordination mechanism, thus limiting the timeliness and coverage of the defense strategy.

[0004] In a first aspect, embodiments of this application provide a server security defense method, the method comprising: acquiring monitoring data of at least one monitoring node of a server and constructing it into a graph data structure; wherein, the nodes of the graph data structure are the monitoring nodes, and the weights of the edges of the graph data structure are determined based on the monitoring data; determining a first global state of the monitoring node based on the monitoring data of the monitoring node and the weights of the edges associated with the monitoring node in the graph data structure; determining a security defense strategy based on the first global state of the monitoring node, and performing security defense on the area where the monitoring node is located based on the security defense strategy.

[0005] Secondly, embodiments of this application provide a server security defense apparatus, comprising: an acquisition module for acquiring monitoring data of at least one monitoring node of a server and constructing it into a graph data structure; wherein the nodes of the graph data structure are the monitoring nodes, and the weights of the edges of the graph data structure are determined based on the monitoring data; a determination module for determining a first global state of the monitoring node based on the monitoring data of the monitoring node and the weights of the edges associated with the monitoring node in the graph data structure; and a security module for determining a security defense strategy based on the first global state of the monitoring node, and performing security defense on the area where the monitoring node is located based on the security defense strategy.

[0006] Thirdly, embodiments of this application provide an electronic device including a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the method described in the first aspect.

[0007] Fourthly, embodiments of this application provide a readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps of the method described in the first aspect.

[0008] Fifthly, embodiments of this application provide a chip, the chip including a processor and a communication interface, the communication interface being coupled to the processor, the processor being used to run programs or instructions to implement the steps of the method described in the first aspect.

[0009] In a sixth aspect, embodiments of this application provide a computer program product, the computer program product including a computer program stored on a non-transitory computer-readable storage medium, the computer program including a program or instructions, which, when executed, implement the steps of the method described in the first aspect.

[0010] In this embodiment, monitoring data from at least one monitoring node of the server is acquired and constructed into a graph data structure, where the monitoring node is the node of the graph data structure, and the weights of the edges between monitoring nodes are determined based on the monitoring data. For each monitoring node, a first global state of the monitoring node is determined based on its monitoring data and the weights of the edges associated with it in the graph data structure. Since the edge weights encompass the monitoring data of the monitoring nodes that constitute the edge, and combine the weights of the edges associated with the monitoring node, the monitoring data of several associated monitoring nodes can be shared. This allows the first global state to characterize not only the relevant features monitored by the monitoring node, but also the relevant features monitored by monitoring nodes associated with it, providing a multi-dimensional data foundation for determining security defense strategies. A security defense strategy is then determined based on the first global state of the monitoring node, and security defense is applied to the area where the monitoring node is located based on the security defense strategy. This enables multiple associated monitoring nodes to work collaboratively, enhancing the coverage and capability of the defense strategy and better addressing complex network environments. Attached Figure Description

[0011] Figure 1 This is a flowchart illustrating a server security defense method provided in an embodiment of this application; Figure 2 This is a flowchart illustrating another server security defense method provided in an embodiment of this application; Figure 3This is a schematic diagram of the structure of a server security defense device provided in an embodiment of this application; Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0012] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0013] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0014] In related technologies, centralized IDS has the following drawbacks: 1) When processing large-scale network data, the performance of IDS is limited by the processing capacity of the central processing unit, making it difficult to efficiently expand processing capacity in large network environments and unable to handle a wider range of network security threats. 2) Due to its reliance on centralized data processing, IDS suffers from latency in data transmission and processing, limiting its ability to respond to network security threats requiring immediate action. 3) Centralized IDS typically rely on pre-defined rule bases for identifying network security threats, making it difficult to adapt to emerging and unknown attack types, such as zero-day attacks. Inaccurate rule matching also leads to high false positive rates, impacting network operational efficiency and potentially causing genuine network security threats to be overlooked. Furthermore, network security management systems typically employ full-network scanning or continuous monitoring, resulting in high resource consumption and maintenance costs. The various security devices or systems within these systems often operate independently, lacking effective coordination mechanisms, thus limiting the coverage and capabilities of defense strategies.

[0015] The server security defense method, apparatus, electronic device, and readable storage medium provided in this application will be described in detail below with reference to the accompanying drawings and through specific embodiments and application scenarios, so as to at least solve the above-mentioned problems.

[0016] Figure 1This diagram illustrates a flowchart of a server security defense method provided in an embodiment of this application. This method can be executed by an electronic device. See also... Figure 1 The method may include the following steps.

[0017] Step 102: Obtain monitoring data from at least one monitoring node of the server and construct it into a graph data structure; wherein, the nodes of the graph data structure are the monitoring nodes, and the weights of the edges of the graph data structure are determined based on the monitoring data.

[0018] The graph data structure, constructed from at least one monitoring node, simulates the topology of monitoring nodes in a real-world network environment. Each monitoring node is responsible for data monitoring, anomaly detection, attack identification, and response in a specific area, enabling timely data processing and responses. Optionally, the monitoring nodes in this graph data structure can be dynamically adjusted. For example, if a certain area requires focused attention while others can be ignored, the constructed graph data structure includes monitoring nodes covering that area instead of all monitoring nodes, thereby optimizing resource allocation and utilization. Furthermore, different graph data structures can be constructed for different types of security threat scenarios, such as Distributed Denial of Service (DDoS) attacks, SQL injection, and malware.

[0019] The monitoring data can include network traffic characteristics such as traffic size, speed, source Internet Protocol (IP), destination IP, and protocol type; system log characteristics such as login attempts, user activity, and system warnings; security threat data such as historical attack events, known attack patterns, and newly discovered vulnerabilities; the operational status of the monitoring node such as Central Processing Unit (CPU) utilization, memory usage, and response time; current security configurations such as firewall rules, intrusion detection settings, and access control lists; and the monitoring node's defense strategies against network security threats such as applying security patches, adjusting security configurations, isolating or redirecting suspicious traffic, activating specific security protocols, and adjusting resource allocation.

[0020] Step 104: Determine the first global state of the monitoring node based on the monitoring data of the monitoring node and the weights of the edges associated with the monitoring node in the graph data structure.

[0021] In this context, the edge associated with the monitoring node consists of one vertex of the monitoring node and the other vertex of its neighboring node. Thus, the first global state of the monitoring node integrates its monitoring data with relevant information from its neighboring nodes, achieving a collaborative mechanism.

[0022] Step 106: Determine a security defense strategy based on the first global state of the monitoring node, and perform security defense on the area where the monitoring node is located based on the security defense strategy.

[0023] The first global state represents the multidimensional information of the monitoring node, providing a more comprehensive data foundation for determining the security defense strategy. This enables the determined security defense strategy to be more suitable for the monitoring node and provide a better security defense strategy for the area under the responsibility of the monitoring node.

[0024] In this embodiment, monitoring data from at least one monitoring node of the server is acquired and constructed into a graph data structure, where the monitoring node is the node of the graph data structure, and the weights of the edges between monitoring nodes are determined based on the monitoring data. For each monitoring node, a first global state of the monitoring node is determined based on its monitoring data and the weights of the edges associated with it in the graph data structure. Since the edge weights encompass the monitoring data of the monitoring nodes that constitute the edge, and combine the weights of the edges associated with the monitoring node, the monitoring data of several associated monitoring nodes can be shared. This allows the first global state to characterize not only the relevant features monitored by the monitoring node, but also the relevant features monitored by monitoring nodes associated with it, providing a multi-dimensional data foundation for determining security defense strategies. A security defense strategy is then determined based on the first global state of the monitoring node, and security defense is applied to the area where the monitoring node is located based on the security defense strategy. This enables multiple associated monitoring nodes to work collaboratively, enhancing the coverage and capability of the defense strategy and better addressing complex network environments.

[0025] In one implementation, step 102 above, which involves acquiring monitoring data from at least one monitoring node of the server and constructing it into a graph data structure, may include the following steps.

[0026] Step 1021: Determine the connection relationship of the monitoring node in the graph data structure based on the network connection relationship of the monitoring node in the server.

[0027] The connection relationships between the nodes in this graph data structure are determined based on the network connection relationships of the monitoring nodes in the server, thereby simulating the topology of the monitoring nodes in a real network environment through the graph data structure.

[0028] Step 1022: For each monitoring node, determine the weight of the edge connecting the monitoring node and the adjacent monitoring node based on the monitoring data of the monitoring node and the monitoring data of the adjacent monitoring node; wherein, the adjacent monitoring node is the monitoring node adjacent to the monitoring node.

[0029] In one optional embodiment, the weight of the edge connecting each monitoring node to its neighboring monitoring nodes is... It can be determined using the following formula: .

[0030] in, Let i be the feature vector corresponding to the selectable defense strategies for network security threats for monitoring node i and its neighboring monitoring node j. and These are the feature vectors corresponding to the monitoring data of monitoring node i and its neighboring monitoring node j at the current time point, respectively, and W is the preset weight.

[0031] Therefore, based on the monitoring data of the monitoring node and the weights of the edges associated with the monitoring node in the graph data structure, the first global state of the monitoring node is determined. It can be determined using the following formula: .

[0032] Step 1023: Construct a graph data structure based on the connection relationship of the monitoring nodes and the weight of the edges.

[0033] In this embodiment, by obtaining the network connection relationship of the monitoring node in the server, the connection relationship of the monitoring node in the graph data structure is determined. Then, by combining the monitoring data of each monitoring node and its adjacent neighboring monitoring nodes, the weight of the edge connecting the monitoring node and its neighboring monitoring nodes is determined. Thus, the nodes, connection relationships, and weights in the graph data structure are determined, forming a topology structure similar to the real network environment, which provides a basis for collaborative work among multiple monitoring nodes.

[0034] In one implementation, step 106 above, which determines the security defense strategy based on the first global state of the monitoring node, may include: inputting the first global state of the monitoring node into the Actor network for processing to obtain the security defense strategy corresponding to the monitoring node.

[0035] The Actor network can process the first global state as follows: .

[0036] Among them, and As weight, and This is a bias term.

[0037] In this embodiment of the application, by introducing an Actor network, the current first global state of the monitoring node is taken as input, and after processing by the Actor network, the probability of each optional security defense strategy is output, thereby determining the security defense strategy that best matches the current first global state.

[0038] In an optional embodiment, the above method may further include the following steps.

[0039] Step 108: Obtain the second global state and reward value of the monitoring node after the server executes the security defense strategy.

[0040] The reward value is used to evaluate the immediate effectiveness of the security defense strategy on the first global state. For example, the immediate effectiveness of the security defense strategy on the first global state can be evaluated through attack detection efficiency, attack blocking success rate, response time, resource utilization efficiency, etc.

[0041] Step 110: Input the first global state, the security defense strategy, the second global state, and the reward value of each monitoring node into the Critic network for processing to obtain the predicted Q value and the target Q value.

[0042] The predicted Q-value is used to evaluate the cumulative execution effect of the security defense strategy on the first global state, and the target Q-value is used to evaluate the long-term execution effect of the security defense strategy. In this embodiment, each monitoring node includes an Actor network and a Critic network. The first global state is obtained by processing it based on its Actor network when determining the security defense strategy. When updating the parameters of the Actor network and the Critic network, the security defense strategy of each monitoring node is evaluated by comprehensively considering the first global state, security defense strategy, and second global state of all monitoring nodes. That is, distributed execution is achieved through the Multi-Agent Deep Deterministic Policy Gradient (MADDPG) algorithm to determine the security defense strategy of each monitoring node. Centralized training, which integrates the first global state, security defense strategy, and second global state of all monitoring nodes, updates the parameters of the Actor network and the Critic network to solve the problem of the instability of the multi-agent environment, which makes it difficult for the Actor network and the Critic network to converge.

[0043] Step 112: Determine the mean square error based on the predicted Q value and the target Q value, and update the parameters of the Critic network based on the mean square error.

[0044] In this embodiment, after determining the security defense strategy corresponding to the monitoring node based on the Actor network, the execution effect of the security defense strategy is evaluated through the Critic network to update the parameters of the Actor network and the Critic network. The second global state and reward value of the monitoring node are obtained after the server executes the security defense strategy; each monitoring node obtains its second global state and reward value. The first global state, the security defense strategy, the second global state, and the reward value of each monitoring node are then input into the Critic network for processing to obtain a predicted Q-value and a target Q-value. The cumulative execution effect of the security defense strategy on the first global state is evaluated using the predicted Q-value, and the long-term execution effect of the security defense strategy is evaluated using the target Q-value. A loss function, which can be mean squared error, is then determined based on the predicted Q-value and the target Q-value, and the parameters of the Critic network are updated based on the mean squared error. This enables the updating of parameters in the Critic network and guides the updating of parameters in the Actor network. As a result, the Actor network can continuously optimize its established security defense strategy. This continuously optimized security defense strategy can adapt to new and unknown attack types, providing better security defense strategies for monitoring nodes and improving the security defense capabilities of the server.

[0045] In one implementation, the above method may further include: determining the policy gradient based on the predicted Q value, and updating the parameters of the Actor network based on the policy gradient.

[0046] In this embodiment, the policy gradient is calculated based on the predicted Q value determined by the Critic network. The policy gradient indicates that the parameters of the Actor network are adjusted in the direction of enhancing the selection of a better security defense strategy. The parameters of the Actor network are updated using the policy gradient, so that the Actor network can continuously optimize its determined security defense strategy. This allows the optimized security defense strategy to adapt to new and unknown attack types, providing better security defense strategies for monitoring nodes and improving the security defense capabilities of the server.

[0047] In one implementation, step 108 above, which involves obtaining the reward value of the monitoring node after the server executes the security defense strategy, may include the following steps.

[0048] Step 1081: Determine the reward function based on at least one of the following: attack detection efficiency; attack prevention success rate; stability of the security defense strategy; resource utilization efficiency.

[0049] Specifically, the attack detection efficiency is set to 1 if an attack is detected and 0 otherwise. The attack prevention success rate is set to 1 if the attack is successfully prevented and 0 otherwise. The stability of the security defense strategy is determined based on the average response time after implementing the strategy and the average response time after normal operation. Resource utilization efficiency is determined based on CPU and memory usage during the implementation of the security defense strategy and during normal operation.

[0050] In one alternative embodiment, the reward function can be: .

[0051] in, As weight. To improve attack detection efficiency, To increase the success rate of attack prevention, For the stability of the aforementioned security defense strategy, To improve resource utilization efficiency.

[0052] Step 1082: Calculate the reward value corresponding to the security defense strategy using the reward function, based on the first global state and the security defense strategy.

[0053] In this embodiment, the reward function is determined by at least one of attack detection efficiency, attack blocking success rate, stability of the security defense strategy, and resource utilization efficiency. This allows the state after the security defense strategy is implemented to be measured from multiple aspects, thereby more accurately evaluating the implementation effect of the security defense strategy. This enables the updates of the Actor network and Critic network to move closer to the direction of determining a better security defense strategy, improving the adaptability of the security defense strategy determined by the Actor network to the current state and enhancing the security defense capability of the server.

[0054] Figure 2 This diagram illustrates a flowchart of another server security defense method provided in an embodiment of this application, which can be executed by an electronic device. See also... Figure 2 The method may include the following steps.

[0055] Step 201: Construct a graph data structure for at least one monitoring node of the server based on the graph attention mechanism.

[0056] Specifically, the connection relationships of monitoring nodes in the graph data structure are defined by the network connectivity of at least one monitoring node within the server, thus constructing the graph data structure. Each monitoring node is responsible for data monitoring, anomaly detection, attack identification, and response in a specific area.

[0057] Step 202: Define the state space and action space of the monitoring node.

[0058] The state space and action space of the monitoring node are determined based on the monitoring data of the monitoring node. The state space of the monitoring node is as follows: , It represents network traffic characteristics, including traffic volume, speed, source IP, destination IP, and protocol type; This indicates system log characteristics, including login attempts, user activity, and system warnings; It represents security threat data, including historical attack events, known attack patterns, and newly discovered vulnerabilities; It indicates the node's running status, including CPU utilization, memory usage, and response time; This indicates the current security configuration, including firewall rules, intrusion detection settings, and access control lists.

[0059] The action space of the monitoring node is as follows: , This indicates that a security patch has been applied. This indicates adjustments to security configurations, such as updating firewall rules or modifying access controls. This indicates that suspicious traffic should be isolated or redirected. This indicates the activation of a specific security protocol; This indicates adjustments to resource allocation, such as bandwidth and processing capacity optimization.

[0060] Step 203: Define the Actor network and the Critic network.

[0061] The Actor network is used to output recommended actions based on the current state. The input layer of the Actor network takes the current state as input. The Actor network has two hidden layers, each using ReLU as the activation function to increase the model's non-linear expressiveness. The first hidden layer has 128 neurons, and the second hidden layer has 256 neurons. The output layer of the Actor network uses the Softmax activation function to output the probability of each possible action, thus forming a probability distribution. .

[0062] The Critic network is used to evaluate the performance of actions determined by the Actor network for all monitoring nodes in the current state. The input layer of the Critic network accepts a concatenated vector of the states and actions of all monitoring nodes. The Critic network has two hidden layers, each using ReLU as the activation function. The first hidden layer has 256 neurons, and the second hidden layer has 128 neurons. The output layer of the Critic network outputs a single scalar value without using an activation function. This represents the value of the current state and the combination of actions.

[0063] Step 204: Define the reward function.

[0064] The reward function is used to evaluate the immediate performance of the Actor network in the current state, and is determined based on at least one of the following: attack detection efficiency; attack prevention success rate; stability of the security defense strategy; and resource utilization efficiency.

[0065] Optionally, the reward function can be: .

[0066] in, As weight. To improve attack detection efficiency, To increase the success rate of attack prevention, For the stability of the aforementioned security defense strategy, For resource utilization efficiency, the value is 1 if an attack is detected and 0 otherwise. For attack prevention success rate, the value is 1 if prevention is successful and 0 otherwise. The stability of the security defense strategy is determined based on the average response time after implementing the security defense strategy and the average response time after normal operation. One possible implementation is as follows: , This indicates the average response time after implementing the security defense strategy; It is the average response time after performing normal operations, and is used as a benchmark for standardized response time; Error rate is the ratio of the number of errors that occur during an operation to the total number of operations. This is the error rate during normal operation; This is an adjustable parameter used to adjust the sensitivity of the stability score. Regarding resource utilization efficiency, it is determined based on CPU and memory usage during normal operation, and one possible implementation is: ,in, and This indicates the amount of memory and CPU used during the execution of security defense strategies; and This represents the CPU and memory usage during normal operation, serving as a standardized benchmark. and It is a weighting coefficient, adjusted according to the importance of the resource.

[0067] In this embodiment of the application, by refining the method of determining the reward value, the reward function is made to better meet the needs of actual security operation, ensuring the best security protection effect and reducing the overall risk of the server.

[0068] Step 205: Determine the weights of the edges in the graph data structure based on the monitoring data of the monitoring nodes.

[0069] Each monitoring node collects monitoring data for its specific area of ​​responsibility and extracts the required features from the monitoring data to form a feature vector. .

[0070] For each monitoring node Aggregate all its neighboring nodes The current feature vector Update edge weights based on real-time data: ,in and These are nodes and The feature vector at the current time point, Preset weights.

[0071] Step 206: Determine the first global state of each monitoring node based on the monitoring data of the monitoring node and the weight of the edges associated with the monitoring node.

[0072] The first global state of each monitoring node is determined based on its monitoring data and the weights of the edges associated with it, using the following formula: .

[0073] Step 207: The first global state is used to determine the recommended action through the Actor network.

[0074] The recommended actions represent security defense strategies, which may include applying security patches, adjusting security configurations, isolating or redirecting suspicious traffic, activating specific security protocols, and adjusting resource allocation.

[0075] The Actor network can process the first global state as follows: .

[0076] Among them, and As weight, and This is a bias term.

[0077] Step 208: Obtain the second global state and reward value of the monitored node after the server executes the action.

[0078] The second global state is determined based on the feature vector extracted from the monitoring data collected by the monitoring node after the server executes an action, and the weights of the edges associated with that monitoring node. The reward value is determined based on the aforementioned reward function.

[0079] Step 209: Input the first global state, recommended action, second global state, and reward value of each monitoring node into the Critic network, output the predicted Q value and the target Q value, and update the parameters of the Critic network based on the predicted Q value and the target Q value.

[0080] Among them, the predicted Q value The target Q value is used to evaluate the cumulative effect of the security defense strategy on the first global state. This is used to evaluate the long-term effectiveness of the security defense strategy. This represents the recommended action determined by the Actor network based on the second global state. This represents the predicted Q-value determined by the Critic network based on the second global state and the recommended action. Indicates the reward value. It is a discount factor used to adjust the importance of future rewards.

[0081] The parameters of the Critic network updated based on the predicted Q-value and the target Q-value include: determining the mean squared error based on the predicted Q-value and the target Q-value. By updating the formula: Update the parameters of the Critic network ,in, It is the learning rate of the Critic network, which controls the step size for parameter updates. It is the gradient of the loss function with respect to the parameters of the Critic network.

[0082] Step 210: Update the parameters of the Actor network based on the predicted Q-value.

[0083] The policy gradient is calculated based on the predicted Q-value: Use this strategy to update the parameters of the Actor network using gradients. : ,in, The learning rate of the actor network.

[0084] By continuously repeating steps 205 to 210, the parameters of the Actor network and Critic network are continuously updated, allowing the Actor network to continuously optimize its determined security defense strategy. This optimized strategy can adapt to newly emerging and unknown attack types, providing monitoring nodes with better security defense strategies and improving the server's security defense capabilities. In this embodiment, through the distributed execution and centralized training characteristics of the MADDPG algorithm, the global state information, security defense strategies, and reward values ​​of each monitoring node can be shared, enabling collaborative work among multiple agents. When facing changes in network scale and new attack threats, the security defense strategy can be quickly adapted and automatically adjusted, thereby improving the server's adaptability to new network security threats and environmental changes.

[0085] It should be noted that the server security defense method provided in this application embodiment can be executed by a server security defense device, or a control module within that server security defense device for executing the server security defense method. This application embodiment uses the execution method of a server security defense device as an example to illustrate the server security defense device provided in this application embodiment.

[0086] Figure 3 This paper shows a schematic diagram of the structure of a server security defense device provided in an embodiment of this application. See also: Figure 3 The device 300 may include: an acquisition module 31, a determination module 32, and a security module 33.

[0087] The acquisition module 31 acquires monitoring data from at least one monitoring node of the server and constructs it into a graph data structure; wherein the nodes of the graph data structure are the monitoring nodes, and the weights of the edges of the graph data structure are determined based on the monitoring data; the determination module 32 is used to determine the first global state of the monitoring node based on the monitoring data of the monitoring node and the weights of the edges associated with the monitoring node in the graph data structure; the security module 33 is used to determine a security defense strategy based on the first global state of the monitoring node, and perform security defense on the area where the monitoring node is located based on the security defense strategy.

[0088] In one implementation, the acquisition module 31 described above can be used to: determine the connection relationship of the monitoring nodes in the graph data structure based on the network connection relationship of the monitoring nodes in the server; for each monitoring node, determine the weight of the edge connecting the monitoring node and the adjacent monitoring node based on the monitoring data of the monitoring node and the monitoring data of the adjacent monitoring node; wherein, the adjacent monitoring node is the monitoring node adjacent to the monitoring node; and construct a graph data structure based on the connection relationship of the monitoring nodes and the weight of the edge.

[0089] In one implementation, the security module 33 described above can be used to: input the first global state of the monitoring node into the Actor network for processing, and obtain the security defense strategy corresponding to the monitoring node.

[0090] In one implementation, the acquisition module 31 described above can also be used to: acquire the second global state and reward value of the monitoring node after the server executes the security defense strategy; wherein the reward value is used to evaluate the immediate execution effect of the security defense strategy on the first global state. The apparatus 300 described above may further include an update module, used to input the first global state of each monitoring node, the security defense strategy, the second global state, and the reward value into a Critic network for processing to obtain a predicted Q-value and a target Q-value; wherein the predicted Q-value is used to evaluate the cumulative execution effect of the security defense strategy on the first global state, and the target Q-value is used to evaluate the long-term execution effect of the security defense strategy; a mean squared error is determined based on the predicted Q-value and the target Q-value, and the parameters of the Critic network are updated based on the mean squared error.

[0091] In one implementation, the update module described above can also be used to: determine the policy gradient based on the predicted Q value, and update the parameters of the Actor network based on the policy gradient.

[0092] In one implementation, the acquisition module 31 described above can be used to: determine a reward function based on at least one of the following: attack detection efficiency; attack prevention success rate; stability of the security defense strategy; resource utilization efficiency; and calculate the reward value corresponding to the security defense strategy by using the reward function to calculate the reward value of the security defense strategy based on the first global state and the security defense strategy.

[0093] The server security defense device in this application embodiment can be an electronic device or a component within an electronic device, such as an integrated circuit or a chip. The electronic device can be a terminal or other devices besides a terminal. For example, the electronic device can be a mobile phone, tablet computer, laptop computer, PDA, in-vehicle electronic device, mobile internet device (MID), augmented reality (AR) / virtual reality (VR) device, robot, wearable device, ultra-mobile personal computer (UMPC), netbook, or personal digital assistant (PDA), etc. It can also be a server, network attached storage (NAS), personal computer (PC), television (TV), ATM, or self-service machine, etc. This application embodiment does not specifically limit the specific implementation.

[0094] The server security defense device in this application embodiment can be a device with an operating system. This operating system can be Android, iOS, or other possible operating systems; this application embodiment does not specifically limit it.

[0095] The server security defense device provided in this application embodiment can achieve... Figures 1 to 2 The various processes implemented in the method implementation examples will not be described again here to avoid repetition.

[0096] Based on the same technical concept, embodiments of this application also provide an electronic device for executing the aforementioned server security defense method. Figure 4 This is a schematic diagram of the structure of an electronic device to implement the various embodiments of this application. The electronic device can vary significantly due to differences in configuration or performance, and may include a processor 401, a communications interface 402, a memory 403, and a communication bus 404. The processor 401, communications interface 402, and memory 403 communicate with each other via the communication bus 404. The processor 401 can call a computer program stored in the memory 403 and executable on the processor 401 to perform the various steps of the above-described server security defense method embodiments, achieving the same technical effects. To avoid repetition, further details are omitted here.

[0097] It should be noted that the electronic devices in the embodiments of this application include servers, terminals, or other devices besides terminals. For example, automobiles, robots, and handheld devices.

[0098] The above electronic device structure does not constitute a limitation on the electronic device. An electronic device may include more or fewer components than illustrated, or combine certain components, or arrange them differently. For example, an input unit may include a Graphics Processing Unit (GPU) and a microphone, and a display unit may use a liquid crystal display (LCD), organic light-emitting diode (OLED), or other similar display panels. User input units include at least one of a touch panel and other input devices. A touch panel is also called a touchscreen. Other input devices may include, but are not limited to, physical keyboards, function keys (such as volume control buttons, power buttons, etc.), trackballs, mice, and joysticks, which will not be elaborated further here.

[0099] Memory can be used to store software programs and various data. Memory can primarily include a first storage area for storing programs or instructions and a second storage area for storing data. The first storage area can store the operating system, application programs or instructions required for at least one function (such as sound playback, image playback, etc.). Furthermore, memory can include volatile memory or non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (Synchlink DRAM, SLDRAM), and direct memory bus RAM (DRRAM).

[0100] The processor may include one or more processing units; optionally, the processor integrates an application processor and a modem processor, wherein the application processor mainly handles operations related to the operating system, user interface, and applications, while the modem processor mainly handles wireless communication signals, such as a baseband processor. It is understood that the aforementioned modem processor may also not be integrated into the processor.

[0101] This application also provides a readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the various processes of the above-described server security defense method embodiments and achieve the same technical effects. To avoid repetition, they will not be described again here.

[0102] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0103] This application embodiment also provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run programs or instructions to implement the various processes of the above-described server security defense method embodiments and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0104] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0105] This application also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes a program or instructions. When the program or instructions are executed, they implement the various processes of the above-described server security defense method embodiments and can achieve the same technical effects. To avoid repetition, they will not be described again here.

[0106] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0107] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0108] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A server security defense method, characterized in that, include: Acquire monitoring data from at least one monitoring node of the server and construct it into a graph data structure; wherein, the nodes of the graph data structure are the monitoring nodes, and the weights of the edges of the graph data structure are determined based on the monitoring data; Based on the monitoring data of the monitoring node and the weights of the edges associated with the monitoring node in the graph data structure, the first global state of the monitoring node is determined. A security defense strategy is determined based on the first global state of the monitoring node, and security defense is carried out on the area where the monitoring node is located based on the security defense strategy.

2. The method according to claim 1, characterized in that, The step of acquiring monitoring data from at least one monitoring node of the server and constructing it into a graph data structure includes: Based on the network connection relationship of the monitoring node in the server, determine the connection relationship of the monitoring node in the graph data structure; For each monitoring node, the weight of the edge connecting the monitoring node and the adjacent monitoring node is determined based on the monitoring data of the monitoring node and the monitoring data of the adjacent monitoring node; wherein, the adjacent monitoring node is the monitoring node that is adjacent to the monitoring node. A graph data structure is constructed based on the connection relationships of the monitoring nodes and the weights of the edges.

3. The method according to claim 1, characterized in that, The security defense strategy determined based on the first global state of the monitoring node includes: The first global state of the monitoring node is input into the Actor network for processing to obtain the security defense strategy corresponding to the monitoring node.

4. The method according to claim 3, characterized in that, The method further includes: Obtain the second global state and reward value of the monitoring node after the server executes the security defense strategy; wherein, the reward value is used to evaluate the immediate execution effect of the security defense strategy on the first global state; The first global state, the security defense strategy, the second global state, and the reward value of each monitoring node are input into the Critic network for processing to obtain the predicted Q value and the target Q value; wherein, the predicted Q value is used to evaluate the cumulative execution effect of the security defense strategy on the first global state, and the target Q value is used to evaluate the long-term execution effect of the security defense strategy. The mean square error is determined based on the predicted Q value and the target Q value, and the parameters of the Critic network are updated based on the mean square error.

5. The method according to claim 4, characterized in that, The method further includes: The policy gradient is determined based on the predicted Q value, and the parameters of the Actor network are updated based on the policy gradient.

6. The method according to claim 4, characterized in that, The step of obtaining the reward value of the monitoring node after the server executes the security defense strategy includes: The reward function is determined based on at least one of the following: attack detection efficiency; attack prevention success rate; stability of the security defense strategy; and resource utilization efficiency. The reward value corresponding to the security defense strategy is calculated using the reward function based on the first global state and the security defense strategy.

7. A server security defense device, characterized in that, include: The acquisition module acquires monitoring data from at least one monitoring node of the server and constructs it into a graph data structure; wherein, the nodes of the graph data structure are the monitoring nodes, and the weights of the edges of the graph data structure are determined based on the monitoring data; The determination module is used to determine the first global state of the monitoring node based on the monitoring data of the monitoring node and the weights of the edges associated with the monitoring node in the graph data structure. The security module is used to determine a security defense strategy based on the first global state of the monitoring node, and to perform security defense on the area where the monitoring node is located based on the security defense strategy.

8. An electronic device, characterized in that, It includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the server security defense method as described in any one of claims 1 to 6.

9. A readable storage medium, characterized in that, The readable storage medium stores a program or instructions that, when executed by a processor, implement the steps of the server security defense method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program including programs or instructions that, when executed, implement the steps of the server security defense method as described in any one of claims 1 to 6.

Images