Multi-tenant adaptive cooperative defense method and system in hybrid cloud scene

Abstract

The invention discloses a multi-tenant adaptive cooperative defense method and system in a hybrid cloud scene, and the method comprises the following steps: obtaining a remote credible proof of hardware, verifying the credibility of a tenant agent and the integrity of a code based on the remote credible proof, granting a mark, and detecting cloud information to generate a machine readable portrait containing key parameters; collecting local multi-mode log data coding embedding vectors of tenants, and after privacy processing, calculating that the abnormal confidence exceeds a threshold value by a local model to trigger current limiting or blocking; and constructing a hierarchical federated architecture containing local nodes of tenants, a regional cloud and a global control plane, encrypting aggregation parameters to generate a cross-tenant attack recognition global model and issuing the cross-tenant attack recognition global model to each tenant on the premise that log data is not out of a domain. According to the invention, integrity verification is carried out on the tenant side security agent through the trusted access mechanism, and the tenant portrait is constructed based on the trusted mark, so that the real and verifiable cooperative defense capability among a plurality of tenants is realized, and the cooperative process has dependency.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security and cloud computing, in particular to a multi-tenant adaptive collaborative defense method and system in a hybrid cloud scenario. BACKGROUND

[0002] With the rapid development of cloud computing technology, enterprise IT architecture is gradually evolving from a single data center to a hybrid cloud architecture of "public cloud, private cloud and edge cloud". This architecture makes full use of the elastic computing power of public cloud, the data security of private cloud and the low delay characteristics of edge cloud. In the hybrid cloud environment, the multi-tenant mode becomes the mainstream, that is, multiple tenants share the underlying physical host, virtual network, storage resources and container runtime.

[0003] Although the hybrid cloud brings improvement in resource utilization and business flexibility, its complex heterogeneous environment and dynamically changing resource attributes also pose great challenges to network security defense. The existing traditional security defense system usually relies on single-point defense tools such as firewalls, web application firewalls, endpoint detection and response, etc. These tools have obvious limitations in dealing with advanced persistent threats and complex attack chains in the hybrid cloud environment.

[0004] Specifically, the existing technology mainly has the following technical problems in the aspects of hybrid cloud and multi-tenant security defense: First, in the hybrid cloud scenario, enterprises often use services from different manufacturers such as AWS, Alibaba Cloud, Huawei Cloud, etc. The security capabilities, log formats, API interface standards and policy management mechanisms of each cloud manufacturer are significantly different. This heterogeneity makes it difficult to uniformly control security policies, inconsistent attack event formats, and defense systems across clouds difficult to collaborate. For example, attack features detected on the public cloud side cannot be synchronized in real time to the private cloud side, allowing the same attacker to easily move between different cloud domains.

[0005] Second, in the multi-tenant environment, due to the sharing of CPU, bandwidth, storage and container runtime, an attack on one tenant can easily affect other tenants in the same physical environment. The existing security isolation mechanism is difficult to prevent container escape, physical machine intrusion and data leakage attacks based on side channels. In addition, the existing technology cannot achieve real-time monitoring of tenant-level resource isolation, and cannot effectively prevent the "neighbor interference" phenomenon caused by an attack on a certain tenant.

[0006] Third, attackers often use "detour" tactics, such as first invading edge nodes, then moving horizontally through tunnels into private clouds, and finally accessing public cloud core resources using tenant permissions. Existing defense systems often lack cross-cloud log aggregation capabilities and cross-tenant behavior modeling capabilities, making it difficult to build a unified attack path view, resulting in scattered alarms for defenders and the inability to identify complete cross-domain attack chains.

[0007] Fourth, hybrid cloud resources are highly dynamic, with dynamic scaling of pods, elastic expansion of virtual machines, and dynamic allocation of IP addresses being the norm. Traditional firewall rules and IDS strategies based on static IP or fixed assets cannot adapt to such changes: new instances that are scaled up may not be bound to security policies in a timely manner, while residual policies after scaling down may cause security vulnerabilities. Existing technologies lack an adaptive security policy update mechanism that can automatically adjust in real time as resources change.

[0008] Fifth, the amount of logs in the cloud environment is huge and the sources are diverse, and the business behavior between tenants is significantly different. Traditional IDS / IPS has difficulty effectively monitoring "east-west traffic" in the cloud, and general detection rules often cannot adapt to the business characteristics of specific tenants, resulting in high false alarm rates. At the same time, due to the dynamic changes of resources, AI models trained based on fixed samples have difficulty in effective continuous learning and updating on each tenant side.

[0009] Sixth, current cloud security defense is mostly single-point combat, lacking cross-tenant threat intelligence sharing and joint blocking capabilities. When a cloud node or tenant is compromised, attack features cannot be automatically shared with other tenants, preventing the defense system from forming a combined force. However, in implementing coordinated defense, there are significant challenges in compliance and privacy: tenant data must be strictly isolated, and how to share threat features and implement joint modeling (such as federated learning) without revealing tenant original data (such as business logs, user privacy) is a difficult problem that existing technologies have not effectively solved.

[0010] Seventh, existing automated response mechanisms are often based on pre-set scripts, lacking rigorous verification of current business status and policy execution consequences. In a multi-tenant environment, a faulty blocking strategy can harm normal business, or even cause the core services of the entire tenant to become unavailable. Existing technologies lack an intent-driven and formally verified policy execution mechanism, making it difficult to ensure security while ensuring business continuity and policy rollback. Therefore, a multi-tenant adaptive collaborative defense method and system in a hybrid cloud scenario are proposed. SUMMARY

[0011] The present application aims to provide a multi-tenant adaptive collaborative defense method and system in a hybrid cloud scenario, achieving automated execution from node access credibility measurement to final security policy.

[0012] The first aspect: in order to realize the above-mentioned purpose, the technical scheme adopted by the present application is as follows: Obtaining remote trusted proof of hardware, verifying tenant agent trustworthiness and code integrity based on the remote trusted proof and granting a mark, detecting cloud information to generate a machine-readable portrait containing key parameters; Collecting tenant local multi-modal log data encoding embedding vectors, after privacy processing, local model calculates abnormal confidence exceeding threshold value to trigger flow limiting or blocking; Building a hierarchical federated architecture containing tenant local nodes, regional clouds and global control plane, under the premise that log data does not go out of the domain, encrypted aggregated parameters generate cross-tenant attack identification global model and issue to each tenant; Based on multi-tenant behavior embedding and event time sequence relationship, build a causal attack graph containing entity and event nodes, after causal inference and graph transformer reasoning, output propagation risk probability and root cause, pivot node; Fusion of local anomaly, global model, propagation risk and threat intelligence matching degree weighted unified score, combined with tenant business criticality and attack situation dynamic alarm threshold; High-level defense intention synthesis cross-cloud execution plan, formal verification does not violate tenant's service level agreement, transaction mode executes defense action, reversible action compensates rollback to restore system.

[0013] In one possible implementation, the remote trusted proof of hardware is obtained, the trustworthiness and code integrity of the tenant agent are verified based on the remote trusted proof, and a mark is granted, and the cloud information is detected to generate a machine-readable portrait containing key parameters, specifically including: In response to the execution of hardware-based remote trusted proof on each tenant-side agent or connector, after verifying the trustworthiness and code integrity of its running environment, the corresponding trusted execution node mark is granted; At the same time, the cloud platform type, interface permission and resource restriction of the tenant side are automatically detected, and a machine-readable tenant portrait containing business criticality, maximum acceptable damage threshold and automatic response level is generated; The remote trusted proof includes: The agent program generates a proof token containing environment measurement hash value, binary hash value and random number inside the trusted hardware, and digitally signs the proof token using the hardware built-in private key; After receiving the proof token, the verification service of the control plane verifies the digital signature and compares whether the environment measurement hash value is in the whitelist, and marks the node as a trusted execution node after verification.

[0014] In one possible implementation, the collection of tenant local multi-modal log data encoding embedding vectors, after privacy processing, local model calculation of abnormal confidence threshold triggers flow limiting or blocking, specifically comprising: Based on the collection of multi-modal log data locally in the tenant, the log data is encoded into behavior embedding vectors using a self-supervised learning model, and differential privacy noise or secure quantization compression processing is performed on the behavior embedding vectors in a trusted execution environment; then the local deployed micro model is used to calculate the abnormal confidence, and local flow limiting or blocking is triggered when the confidence exceeds the threshold; The behavior embedding vector generation process includes: For time series log data, a time series transformer model is used for encoding; For call chain and process tree structure data, a graph to vector algorithm is used for encoding; The self-supervised learning model generates a representation vector with generalization ability through a contrast learning technique.

[0015] In one possible implementation, the construction of a hierarchical federated architecture containing tenant local nodes, regional clouds and global control planes generates a global model with cross-tenant attack recognition under the premise that log data does not leave the domain, specifically comprising: A hierarchical federated learning architecture containing tenant local nodes, regional cloud aggregators and global control plane aggregators is constructed; under the premise that the original log data does not leave the domain, the encrypted gradient or model parameter uploaded by each tenant is summarized layer by layer using a secure encrypted aggregation protocol to generate a global model with cross-tenant attack pattern recognition capability, and the updated global model is distributed to each tenant; The hierarchical federated learning architecture also includes a split learning mechanism: For data containing sensitive features, the model is split into a front-end network and a back-end network, and the tenant end only trains and uploads the intermediate layer activation value of the model front-end network, which is mathematically irreversible to the original input data; The control plane is responsible for training the model back-end network.

[0016] The hierarchical federated learning architecture also includes a split learning mechanism: For data containing sensitive features, the model is split into a front-end network and a back-end network, and the tenant end only trains and uploads the intermediate layer activation value of the model front-end network, which is mathematically irreversible to the original input data; The control plane is responsible for training the model back-end network.

[0017] In one possible implementation, the secure encrypted aggregation protocol specifically includes: The tenant node encrypts the gradient and uploads it to the regional aggregator, and the regional aggregator calculates the regional model and uploads it to the global aggregator for aggregation; The aggregation process of the global aggregator adopts a secure multi-party computation protocol to ensure that any single-point aggregator cannot analyze the clear-text gradient value of a single tenant; And all weight update operations are recorded in a chain hash log for auditing.

[0018] In one possible implementation, the multi-tenant behavior embedding and event timing relationship are used to construct a causal attack graph containing entity and event nodes, and the causal inference and graph transformer reasoning are used to output the propagation risk probability and root cause and pivot nodes, specifically including: A causal attack graph is constructed and a graph transformer reasoning is performed; based on the multi-tenant behavior embedding vector and the event timing relationship, a causal attack graph containing entity nodes and event nodes is constructed; a causal inference method is used to identify the causal edges between events, and a graph transformer model is used to reason about the attack graph, outputting the propagation risk probability of each node and the root cause node and pivot node in the attack link; The causal inference method is used to identify the causal edges between events, specifically including: Granger causality test, time point process and structural causal model are comprehensively used to determine whether the first event is the potential cause of the second event based on the time sequence, behavior similarity and context environment of the event, and to establish a directional causal edge in the causal attack graph; The unified score is obtained by fusing the local anomaly, global model, propagation risk and threat intelligence matching degree weighting, and the tenant business criticality and attack situation are combined to dynamically adjust the alarm threshold, specifically including: In response to the fusion of the local anomaly detection score, the global model score, the propagation risk value derived from the causal graph, and the threat intelligence matching degree, a unified threat score is generated by weighted calculation; and according to the business criticality in the tenant portrait and the current overall attack situation, the alarm threshold for determining the threat level is dynamically adjusted.

[0019] In one possible implementation, the high-level defense intention is synthesized into a cross-cloud execution plan, which is verified by formal verification to not violate the service level agreement of the tenant, the defense action is executed in transaction mode, and the reversible action is compensated and rolled back to restore the system, specifically including: The high-level defense intention is automatically synthesized into a specific cross-cloud execution plan, and the formal verification method is used to verify whether the execution plan violates the service level agreement of the tenant before execution; the defense action in the execution plan is executed in transaction mode, and each reversible action is configured with a corresponding compensation rollback operation to support the recovery of system state in case of misjudgment or abnormality; The execution plan is checked by using a formal verification method before execution to check whether the execution plan violates the service level agreement of the tenant, and specifically includes: The execution plan is checked by using a formal verification method before execution to check whether the execution plan violates the service level agreement of the tenant, and specifically includes: The execution plan is checked by using a formal verification method before execution to check whether the execution plan violates the service level agreement of the tenant, and specifically includes: The transaction mode execution adopts a compensation transaction mechanism. The execution plan is decomposed into a series of ordered sub-operations, including blocking traffic, limiting access, generating snapshots, and isolating containers. If any sub-operation fails or receives a rollback instruction, the system automatically triggers the corresponding compensation operation to roll back the environment state to the state before the sub-operation is executed.

[0020] Second aspect: to solve the above technical problems, another technical solution adopted by the present application is: a multi-tenant adaptive collaborative defense system in a hybrid cloud scenario, comprising: A trusted profile module is configured to perform hardware-based remote trusted attestation on each tenant-side agent or connector, grant corresponding trusted execution node labels after verifying the trustworthiness of the running environment and the code integrity, and automatically detect the cloud platform type, interface permissions, and resource restrictions on the tenant side to generate a machine-readable tenant profile containing business criticality, maximum acceptable damage threshold, and automatic response level. A local anomaly detection module is configured to collect multi-modal log data locally on the tenant side, encode the log data into behavior embedding vectors using a self-supervised learning model, and perform differential privacy noise addition or secure quantization compression processing on the behavior embedding vectors in a trusted execution environment. Then, a micro model deployed locally is used to calculate the anomaly confidence, and local throttling or blocking is triggered when the confidence exceeds a threshold. A federated aggregation module is configured to build a hierarchical federated learning architecture including tenant local nodes, regional cloud aggregators, and global control plane aggregators. Under the premise of keeping the original log data within the domain, encrypted gradients or model parameters uploaded by each tenant are aggregated layer by layer using a secure encryption aggregation protocol to generate a global model with cross-tenant attack pattern recognition capability, and the updated global model is distributed to each tenant. The attack graph inference module is configured to construct a causal attack graph and perform graph transformer inference; based on the behavior embedding vectors and the event time sequence relationship of the multiple tenants, an attack graph containing entity nodes and event nodes is constructed; a causal inference method is used to identify the causal edges between events, and a graph transformer model is used to infer the attack graph, and the propagation risk probability of each node and the root cause node and pivot node in the attack link are output; The score threshold adjusting module is configured to generate a unified threat score by weighted calculation in response to the fusion of the local anomaly detection score, the global model score, the propagation risk value derived from the causal graph, and the threat intelligence matching degree; and dynamically adjust the alarm threshold used to determine the threat level according to the business criticality in the tenant portrait and the current overall attack posture. The verification rollback module is configured to automatically synthesize high-level defense intentions into specific cross-cloud execution plans, and use a formal verification method to verify whether the execution plan violates the service level agreement of the tenant before execution; the defense actions in the execution plan are executed in a transaction mode, and a corresponding compensation rollback operation is configured for each reversible action to support the recovery of the system state in the case of misjudgment or abnormality.

[0021] A third aspect of the embodiments of the present disclosure is that to solve the above technical problems, another technical solution adopted by the present application is an electronic device, comprising a processor, a memory and a communication interface, the memory stores a computer program, and the processor executes the computer program to implement the steps of the multi-tenant adaptive collaborative defense method in the hybrid cloud scenario.

[0022] A fourth aspect of the embodiments of the present disclosure is that to solve the above technical problems, another technical solution adopted by the present application is a computer readable storage medium, the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the multi-tenant adaptive collaborative defense method in the hybrid cloud scenario.

[0023] Compared with the prior art, the present application has the following advantages: 1、The present application verifies the integrity of the tenant side security agent through a trusted access mechanism, and constructs a tenant portrait based on a trusted marker, realizes the real and verifiable collaborative defense capability between multiple tenants, and makes the collaboration process reliable.

[0024] 2、The present application enables each tenant to participate in collaborative training without exposing original data through privacy preprocessing and encryption aggregation technologies.

[0025] 3、The application can identify the propagation path of attacks on different tenants and different cloud environments by constructing a multi-dimensional correlation graph containing events, hosts, users, images and attack behaviors, breaking through the limitation of traditional single-tenant IDS that can only see "local fragments".

[0026] 4、The application adopts local anomaly judgment results, collaborative model output, attack graph inference results and external threat intelligence for fusion to generate unified and traceable threat scores, significantly reducing false positives and false negatives.

[0027] 5、The application dynamically selects a collaborative defense strategy according to the threat score and tenant individualized risk preference, and introduces a strategy consistency check and a rollback mechanism to realize automatic and controllable collaborative defense execution.

[0028] 6、The application verifies the impact on business continuity before executing the defense action, and guarantees that the business state can be quickly restored in the case of misjudgment or strategy error through the rollback mechanism, improving the overall availability of the hybrid cloud environment. BRIEF DESCRIPTION OF DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiment or prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0030] Figure 1 is a flow diagram of the multi-tenant adaptive collaborative defense method in the hybrid cloud scenario of the present application. Figure 2 is a block diagram of the multi-tenant adaptive collaborative defense system in the hybrid cloud scenario of the present application. Figure 3 is a structural diagram of an electronic device. DETAILED DESCRIPTION

[0031] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0032] Figure 1 is a flow diagram of the multi-tenant adaptive collaborative defense method in the hybrid cloud scenario of the present application. It should be noted that the method of the present application does not necessarily have the same result as the method of the present application. Figure 1The flow sequence shown is limited.

[0033] Embodiment one: As Figure 1 The multi-tenant adaptive collaborative defense method in the hybrid cloud scenario shown by the present application comprises the following steps: Step 1: Obtain the remote trusted proof of hardware, verify the trustworthiness and code integrity of the tenant agent based on the remote trusted proof, and grant the mark, detect the cloud information to generate a machine-readable portrait containing key parameters; In response to performing hardware-based remote trusted proof on each tenant-side agent or connector, grant the corresponding trusted execution node mark after verifying the trustworthiness and code integrity of its running environment; At the same time, automatically detect the cloud platform type, interface permission and resource restriction of the tenant side, generate a machine-readable tenant portrait containing business criticality, maximum acceptable damage threshold and automatic response level; In the embodiment of the present disclosure, the remote trusted proof comprises: The agent program generates a proof token containing an environment measurement hash value, a binary hash value and a random number inside the trusted hardware, and digitally signs the proof token using the hardware built-in private key; After receiving the proof token, the verification service of the control plane verifies the digital signature and compares whether the environment measurement hash value is in the whitelist, and marks the node as a trusted execution node after verification.

[0034] In the embodiment of the present disclosure, the problem of "zero trust" access in the cloud native environment is solved. The core goal is to ensure that each node (i.e. the agent program or connector on the tenant side) that joins the system runs in a real and trusted environment, its permission range can be verified, and its security attributes and executable capabilities can be quantified. The system will automatically generate a machine-readable tenant portrait for subsequent collaborative training and policy execution.

[0035] When the agent program starts, the system performs a remote trusted proof process using a trusted execution environment (such as Intel Software Guard Extensions SGX, AMD Secure Encrypted Virtualization SEV or Trust Zone technology).

[0036] The agent program generates a hash value of the environment measurement (i.e. the measurement value after the code and initial data are loaded into the memory) inside the trusted hardware, a binary hash value of the agent program, and a random number issued by the management platform. Then, the above data is digitally signed using the hardware built-in private key. After receiving the proof token, the verification service of the control plane verifies the signature, compares whether the measurement value is in the whitelist, and marks the node as a trusted execution node after verification.

[0037] The connector component automatically detects and reports the permissions and resource status of the current environment. This includes detecting executable application interface permissions, such as whether there is permission to modify security group rules, isolate containers, or snapshot the host; detecting restricted resource conditions, such as whether there is only read-only permission; and identifying the underlying cloud platform type, such as Amazon Cloud, Google Cloud, Microsoft Cloud, or a private cloud environment. Based on the detection results, the system generates a capability certificate and writes it into the tenant profile.

[0038] The system generates a risk profile based on the business attributes filled in by the tenant. First, the business criticality is determined, which is divided into four levels: critical, high, medium, and low. Second, the maximum acceptable damage threshold is set, for example, the maximum proportion of containers allowed to be isolated and removed. Finally, the automatic response level is set, including different levels such as only alarm, flow limiting processing, and isolation processing.

[0039] For example, there are two tenants, tenant A and tenant B, accessing the security system.

[0040] Tenant A's situation: The agent program of tenant A runs inside a virtual machine that supports AMD Secure Encrypted Virtualization technology. The hardware signature generated when the agent program starts is verified by the control plane. The system marks it as a trusted node and confirms in the capability certificate that it has complete execution permission. Therefore, the system allows automatic isolation operations on the tenant's resources.

[0041] Tenant B's situation: The agent program of tenant B runs in a normal virtual machine without a trusted execution environment. Since it cannot provide hardware-level trusted proof, the system marks it as a non-complete trusted node and restricts it to "observation mode". In step six, even if a threat is detected, the system is prohibited from performing any destructive blocking actions on tenant B to prevent the agent program from being hijacked and damaging the business.

[0042] Step 2: Collect local multi-modal log data, encode embedding vectors, and calculate abnormal confidence after privacy processing. If the confidence exceeds the threshold, trigger local flow limiting or blocking; Based on the collection of multi-modal log data in the tenant, the self-supervised learning model is used to encode the log data into behavior embedding vectors, and the differential privacy noise or secure quantization compression processing is performed on the behavior embedding vectors in the trusted execution environment. Then, the local micro-model is used to calculate the abnormal confidence, and when the confidence exceeds the threshold, the local flow limiting or blocking is triggered; In the embodiment of the present disclosure, the behavior embedding vector generation process includes the following: For time series log data, a time series transformer model is used for encoding; For call chain and process tree structure data, a graph-to-vector algorithm is used for encoding; The self-supervised learning model generates a representation vector with generalization ability through a contrastive learning technique.

[0043] In the embodiments of the present disclosure, the massive logs generated by the host, container and network are converted into high-quality, privacy-safe and federated training-joinable vector representations.

[0044] The system locally collects data from multiple sources, including network traffic data containing five-tuples and statistics, system call traces in system audit logs, process tree structures, events of container orchestration systems, and image fingerprint information.

[0045] The collected raw data is sent to a self-supervised learning model for encoding. For time-series logs, the system uses a time-series transformer model for processing; for call chains and process tree structures, a graph-to-vector algorithm is used for encoding. Through a contrastive learning technique, the system generates a representation vector with generalization ability, i.e., a behavior embedding vector, which usually has a dimension between sixty-four and two hundred fifty-six.

[0046] To protect data privacy, all processing is done within a trusted execution environment. The system uses differential privacy techniques to add small differential noise to the generated vector to avoid attackers from reverse-engineering the original log content. At the same time, secure quantization techniques are used to compress the vector, reducing the risk of attackers reconstructing the data. The processed vector is encrypted and uploaded to the cloud.

[0047] A lightweight micro-model is deployed locally. This model receives the embedding vector as input and outputs an anomaly confidence score (a value between zero and one). When the confidence score is high, it can be used to trigger local throttling or blocking measures in advance.

[0048] For example, a series of execution sequences occur within a container: first, a file is downloaded using the curl tool, then the file is decompressed, then the file permissions are modified to be executable, then a script is run, and finally an outbound network connection is initiated.

[0049] Vectorization and privacy processing: After encoding by the transformer model, this sequence generates a one-hundred twenty-eight-dimensional vector. Within the trusted execution environment, the system adds weak noise to the vector, converting the original value (e.g., zero point twelve) to a noisy value (e.g., zero point twelve plus noise).

[0050] Local detection and upload: The local micro-model calculates the anomaly confidence score of this behavior as zero point eighty-two. Based on this high confidence score, the system immediately triggers the local throttling policy, limiting the bandwidth of the container to thirty percent, and uploads the noisy vector for subsequent federated aggregation.

[0051] Step 3: Construct a hierarchical federated architecture containing tenant local nodes, regional clouds, and a global control plane. On the premise that log data does not leave the domain, encrypted aggregated parameters are used to generate a global model for cross-tenant attack identification and to distribute each tenant. A hierarchical federated learning architecture is constructed, including tenant local nodes, regional cloud aggregators, and global control plane aggregators. On the premise that the original log data does not leave the domain, the encrypted gradients or model parameters uploaded by each tenant are summarized layer by layer using a secure encrypted aggregation protocol to generate a global model with cross-tenant attack pattern recognition capability, and the updated global model is distributed to each tenant. In the embodiments of the present disclosure, the hierarchical federated learning architecture further includes a split learning mechanism: For data containing sensitive features, the model is split into a front-end network and a back-end network, and the tenant end only trains and uploads the intermediate layer activation values of the front-end network of the model. The intermediate layer activation values cannot be mathematically reversed to the original input data. The control plane is responsible for training the back-end network of the model.

[0052] The secure encrypted aggregation protocol specifically includes: The tenant node uploads the encrypted gradient to the regional aggregator, the regional aggregator calculates the regional model and uploads it to the global aggregator for summarization; The aggregation process uses a secure multi-party computation protocol to ensure that any single-point aggregator cannot analyze the clear-text gradient value of a single tenant. And all weight update operations are recorded in a chain hash log for auditing.

[0053] In the embodiments of the present disclosure, multiple tenants are allowed to jointly train a global attack detection model while ensuring that the original log is not exposed, privacy is not leaked, and other tenant data is not accessed without authorization.

[0054] The system adopts a hierarchical structure, including tenant local nodes, regional cloud data center aggregators, and global control plane aggregators. This architecture can reduce network bandwidth consumption and improve the fault tolerance of the system, allowing local regions to train first.

[0055] During model updating, the tenant first encrypts the gradient, then uploads it to the regional aggregator, and finally summarizes it by the global aggregator. During the entire process, any single-point aggregator cannot see the clear-text gradient value of a single tenant. The system uses a secure aggregation protocol such as Google's or secure multi-party computation (such as Shamir secret sharing or Paillier homomorphic encryption) to achieve this goal.

[0056] For certain particularly sensitive features (such as identity authentication tokens or user behavior data), the system employs split learning techniques. The tenant side only trains the first few layers of the model, and the control plane trains the last few layers. The tenant uploads only the activation values of the intermediate layers, which are mathematically irreversible to the original input.

[0057] All weight update operations are recorded in a chain hash log to ensure traceability and auditability of the model training process.

[0058] For example, assume that there are three tenants participating in collaborative training. Every thirty minutes, each tenant encrypts and uploads the gradient generated by local training.

[0059] The regional aggregator receives the encrypted gradient and calculates the regional model. The global aggregator further combines the regional models to obtain the updated global model.

[0060] The updated global model is distributed to each tenant. Through this process, all tenants have the ability to identify cross-tenant attack patterns (such as supply chain attacks), even if some tenants have never encountered such attacks before.

[0061] Step 4: Based on the multi-tenant behavior embedding and event timing relationship, a causal attack graph containing entity and event nodes is constructed, and through causal inference and graph transformer reasoning, the propagation risk probability and root cause and pivot nodes are output; A causal attack graph is constructed and graph transformer reasoning is performed; based on the multi-tenant behavior embedding vector and the event timing relationship, a causal attack graph containing entity nodes and event nodes is constructed; the causal inference method is used to identify the causal edges between events, and the graph transformer model is used to reason about the attack graph, outputting the propagation risk probability of each node and the root cause node and pivot node in the attack link; In the embodiments of the present disclosure, the causal inference method is used to identify the causal edges between events, specifically including: Comprehensively use Granger causality test, time point process and structural causal model, based on the time sequence, behavior similarity and context environment of the event, judge whether the first event is the potential cause of the second event, and establish a directional causal edge in the causal attack graph.

[0062] In the embodiments of the present disclosure, not only the similarity between events is identified, but also the causal relationship between events is judged, and the root cause node and potential propagation link of the attack are found out.

[0063] The system constructs a graph containing two types of nodes: one type is event nodes (such as login, pull image, and execute process), and the other type is entity nodes (such as host, IP address, user, and image). The edges in the graph represent different types of relationships: time edges represent time sequence-based associations; similarity edges represent cosine distance-based embedding vector associations; and causal edges represent the logical relationship that event A leads to event B.

[0064] The system uses Granger causality test, time point process, and structural causal model methods to comprehensively consider time sequence, behavior similarity, and context environment to determine whether event A is a potential cause of event B.

[0065] The system uses the graph transformer model to reason about the constructed attack graph and outputs the propagation risk probability of each node and the pivot node in the attack path.

[0066] The system also outputs the explanation basis for determining the causal relationship, such as "image hash consistency," "time interval within a certain range," or "high similarity of call chain above a threshold."

[0067] For example, a continuous integration process of a code hosting platform pushes an image, and then the same malicious process suddenly appears in a multi-tenant environment.

[0068] The system constructs a graph and analyzes the causal chain: the continuous integration push at time point one leads to image deployment at time point two, which in turn leads to process abnormalities at time point three.

[0069] The graph transformer reasoning concludes that the propagation risk of this attack is 0.87. At the same time, the system determines that the root cause node of the attack is the continuous integration pipeline.

[0070] Step 5: Fuse local anomalies, global model, propagation risk, and threat intelligence matching degree weighted unified score, combine tenant business criticality and attack posture to dynamically adjust alarm threshold; In response to the fusion of local anomaly detection score, global model score, causal graph derived propagation risk value, and threat intelligence matching degree, a unified threat score is generated through weighted calculation; and according to the business criticality in the tenant portrait and the current overall attack posture, the alarm threshold for determining the threat level is dynamically adjusted; In the embodiments of the present disclosure, scores from different sources are fused to give a unified, reliable, and interpretable risk score.

[0071] The final threat score is obtained through weighted calculation, and its components include: local detection score, global model score, causal propagation risk value, and threat intelligence matching degree.

[0072] The system outputs the proportion of each component in the final score, clearly showing how much each of local detection, global model, causal propagation, and threat intelligence matching contributes to the score.

[0073] The system automatically adjusts the decision threshold according to the business criticality generated in step one and the current overall attack situation. For example, in critical business scenarios or during high attack periods, the threshold will be automatically adjusted to adapt to security needs.

[0074] According to the scoring results, the system provides graded action recommendations: when the score is higher than 0.95, automatic isolation is recommended; when the score is between 0.7 and 0.95, manual review is recommended; and when the score is less than 0.7, monitoring status is recommended.

[0075] For example: the system receives the following scores from the following sources: local detection score is 0.8, global model score is 0.6, propagation risk score is 0.9, and threat intelligence matching degree is 1 (i.e. complete match).

[0076] After weighted fusion, the system calculates the final threat score as 0.84.

[0077] Since the score is in the interval of 0.7 to 0.95, the system gives the recommended action as "semi-automatic isolation", i.e. it suggests performing isolation operations, but needs tenant authorization confirmation.

[0078] Step 6: High-level defense intentions are synthesized into cross-cloud execution plans, which are formally verified not to violate tenant service level agreements, and defense actions are executed in transaction mode with compensation rollback to restore the system.

[0079] Based on automatically synthesizing high-level defense intentions into specific cross-cloud execution plans, and using formal verification methods to verify whether the execution plans violate tenant service level agreements before execution; defense actions in the execution plans are executed in transaction mode, and each reversible action is configured with a corresponding compensation rollback operation to support system state recovery in case of misjudgment or abnormal conditions.

[0080] In the embodiments of the present disclosure, the verification of whether the execution plan violates the tenant service level agreement before execution specifically includes: Using satisfiability modulo theories solvers or bounded model checking techniques to verify whether the system state after implementing the execution plan meets the minimum service replica number limit, service reachability requirement, and business continuity threshold set in the tenant profile; The execution of defense actions in the execution plan in transaction mode and the configuration of corresponding compensation rollback operations for each reversible action specifically include: The transaction mode execution adopts a compensation transaction mechanism; The execution plan is decomposed into a series of ordered sub-operations, including blocking traffic, limiting access, generating snapshots, and isolating containers. If any sub-operation fails to execute or receives a rollback instruction, the system automatically triggers the corresponding compensation operation to roll back the environment state to the state before the sub-operation was executed.

[0081] In the embodiments of the present disclosure, the risk score generated in the previous step is converted into a safe, trusted, and rollbackable coordinated action.

[0082] The user does not need to write complex underlying rules, but only needs to express high-level intentions, such as "isolate suspicious containers but keep evidence available". The system will automatically synthesize this intention into specific operation instructions, such as modifying security group rules, adjusting service mesh flow control policies, generating system snapshots, and marking evidence tags, etc.

[0083] Before the policy is executed, the system uses satisfiability modulo theories solvers or bounded model checking techniques for formal verification. The purpose of verification is to ensure that the generated execution plan does not violate the tenant's service level agreement, such as the minimum number of container replicas, service reachability requirements, and business continuity thresholds, etc.

[0084] The system executes the policy in a transaction mode to ensure the atomicity and reversibility of the operation. The rollbackable nature of the execution chain ensures that the cost of false positives is extremely low in the case of misjudgment.

[0085] For example: based on the high threat score of 0.96 derived in step 5, the system receives the intention instruction "isolate the container and preserve the scene".

[0086] The system first verifies the service level agreement to confirm that the remaining number of replicas after isolating the container meets the requirement of at least three replicas. After verification, the system executes the generated policy plan.

[0087] All execution actions are recorded in a chain hash log. If it is found to be a false positive or to have caused a failure after the operation, the administrator can issue a rollback instruction, and the system will automatically roll back the environment state to the state before the traffic was blocked (i.e., the state of step 2).

[0088] Embodiment two: As Figure 2 shown to solve the above technical problems, on the basis of embodiment one, another technical solution adopted by the present application is: a multi-tenant adaptive coordinated defense system in a hybrid cloud scenario, comprising: A trusted image module is configured to perform hardware-based remote trusted attestation on each tenant-side agent or connector, and grant a corresponding trusted execution node label after verifying the trustworthiness and code integrity of the running environment; meanwhile, the trusted image module is configured to automatically detect the cloud platform type, interface permissions and resource restrictions of the tenant side, and generate a machine-readable tenant image containing business criticality, maximum acceptable damage threshold and automatic response level; A local anomaly detection module is configured to collect multi-modal log data locally in the tenant, encode the log data into behavior embedding vectors using a self-supervised learning model, and perform differential privacy noise addition or secure quantization compression processing on the behavior embedding vectors in a trusted execution environment; subsequently, the local anomaly detection module is configured to calculate an anomaly confidence using a locally deployed micro model, and trigger local throttling or blocking when the confidence exceeds a threshold. A federated aggregation module is configured to build a hierarchical federated learning architecture containing tenant local nodes, regional cloud aggregators and global control plane aggregators; using a secure encryption aggregation protocol, the federated aggregation module is configured to aggregate encrypted gradients or model parameters uploaded by each tenant layer by layer, generate a global model with cross-tenant attack pattern recognition capability, and distribute the updated global model to each tenant; A graph reasoning module is configured to build a causal attack graph and perform graph transformer reasoning; based on the behavior embedding vectors and event timing relationships of multiple tenants, the graph reasoning module is configured to build a causal attack graph containing entity nodes and event nodes; using causal inference methods, the graph reasoning module is configured to identify causal edges between events, and output the propagation risk probability of each node and the root cause nodes and pivot nodes in the attack link by reasoning the attack graph through a graph transformer model. A score adjustment module is configured to generate a unified threat score by weighted calculation in response to the fusion of local anomaly detection scores, global model scores, propagation risk values derived from causal graphs, and threat intelligence matching degrees; and dynamically adjust the alarm threshold for determining the threat level according to the business criticality in the tenant image and the current overall attack posture. A verification and rollback module is configured to automatically synthesize high-level defense intentions into specific cross-cloud execution plans, and verify whether the execution plan violates the service level agreement of the tenant using formal verification methods before execution; the verification and rollback module is configured to execute defense actions in the execution plan in a transaction mode, and configure corresponding compensation rollback operations for each reversible action to support system state recovery in case of misjudgment or abnormal conditions.

[0089] For other details of the implementation of the technical solutions of the modules in the above-mentioned embodiment one system, please refer to the description of the multi-tenant adaptive collaborative defense method in the hybrid cloud scenario in the above-mentioned embodiments.

[0090] It should be noted that each of the embodiments in the specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts of each embodiment can be mutually referred to.

[0091] Embodiment three: As Figure 3 A structural schematic diagram of an electronic device is provided for the embodiments of the present disclosure. It shows a structural schematic diagram suitable for implementing the electronic device in the embodiments of the present disclosure. Figure 3 The electronic device shown is only an example and should not impose any limitations on the functions and use range of the embodiments of the present disclosure.

[0092] As Figure 3 An electronic device is shown, which includes a processor, a memory and a communication interface. The memory stores a computer program, and the processor executes the computer program to implement the multi-tenant adaptive collaborative defense method in the hybrid cloud scenario of the foregoing embodiments of the present disclosure. The electronic device can exchange data with other devices or systems through the communication interface to realize real-time updating and sharing of drug information.

[0093] The processor in the above electronic device is the core of the electronic device. The processor is responsible for executing the computer program stored in the memory to realize various functions of the intelligent defense method of paperless conference terminals. The processor can use a high-performance multi-core CPU or a special-purpose chip to meet the needs of complex calculations and real-time processing. The memory is used to store the operating system, application programs, data and computer programs, etc. In the present embodiment, the memory stores the computer program for implementing the intelligent defense method of paperless conference terminals. The memory can be RAM, ROM, Flash memory or other types of non-volatile memory. The communication interface is used to connect the electronic device with other devices or networks to realize the transmission and exchange of data. In the present embodiment, the communication interface supports multiple communication protocols and interface standards, such as Wi-Fi, Bluetooth, USB, Ethernet, etc., to meet the communication needs in different scenarios.

[0094] The detailed description of the present embodiment can refer to the corresponding description in the foregoing embodiments, which will not be repeated here.

[0095] Embodiment four: A computer-readable storage medium according to an embodiment of the present disclosure stores a computer program. When the computer program is executed by a processor, it realizes the functions of the multi-tenant adaptive collaborative defense method in the hybrid cloud scenario of the foregoing embodiments of the present disclosure.

[0096] The computer readable storage medium described above includes, but is not limited to, an optical storage medium (for example, a CD-ROM and a DVD), a magneto-optical storage medium (for example, an MO), a magnetic storage medium (for example, a magnetic tape or a mobile hard disk), a medium with a built-in rewritable nonvolatile memory (for example, a memory card), and a medium with a built-in ROM (for example, a ROM cartridge).

[0097] Detailed descriptions of the present embodiment can refer to the corresponding descriptions in the foregoing embodiments, and will not be repeated here.

[0098] The above only describes the preferred embodiments of the present application and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A multi-tenant adaptive collaborative defense method in a hybrid cloud scenario, characterized in that, Includes the following steps: Obtain remote trusted proof of hardware, verify the trustworthiness and code integrity of tenant agent based on the remote trusted proof and grant a tag, and detect cloud information to generate a machine-readable profile containing key parameters; Collect tenant's local multimodal log data, encode and embed vectors, and after privacy processing, calculate the abnormal confidence level in the local model. If the value exceeds the threshold, trigger rate limiting or blocking. Construct a hierarchical federated architecture that includes tenant local nodes, regional clouds, and a global control plane. Under the premise that log data does not leave the domain, encrypt and aggregate parameters to generate a global model for cross-tenant attack identification and distribute it to each tenant. Based on multi-tenant behavior embedding and event sequence relationship, a causal attack graph containing entities and event nodes is constructed. After causal inference and graph transformer reasoning, the probability of propagation risk, root cause, and hub node are output. A unified score is obtained by integrating local anomalies, global models, propagation risks, and threat intelligence matching, and the alarm threshold is dynamically adjusted based on the criticality of tenant business and attack situation. The high-level defense intent is to synthesize a cross-cloud execution plan, which is formally verified to not violate the tenant's service level agreement. The defense actions are executed in transaction mode, and reversible actions are matched with compensation rollback to restore the system.

2. The defense method according to claim 1, characterized in that, The process of obtaining remote trusted proof of hardware, verifying tenant agent trustworthiness and code integrity based on the remote trusted proof and assigning a tag, and probing cloud information to generate a machine-readable profile containing key parameters specifically includes: In response to performing hardware-based remote trust verification on each tenant's agent or connector, the system grants a corresponding trusted execution node tag after verifying the trustworthiness of its runtime environment and the integrity of its code. At the same time, it automatically detects the cloud platform type, interface permissions, and resource constraints on the tenant's side, and generates a machine-readable tenant profile that includes business criticality, maximum acceptable damage threshold, and automatic response level. The remote trusted proof includes: The agent program generates a proof token containing an environmental metric hash value, a binary hash value, and a random number inside the trusted hardware, and digitally signs the proof token using the hardware's built-in private key. Upon receiving the proof token, the verification service in the control plane verifies the digital signature and compares the environmental metric hash value with the whitelist. If the verification is successful, the node is marked as a trusted execution node.

3. The defense method according to claim 1, characterized in that, The collected tenant's local multimodal log data is encoded and embedded into a vector. After privacy processing, the local model calculates anomaly confidence levels exceeding a threshold to trigger rate limiting or blocking. Specifically, this includes: Based on multimodal log data collected locally by the tenant, the log data is encoded into behavior embedding vectors using a self-supervised learning model, and differential privacy noise addition or secure quantization compression processing is performed on the behavior embedding vectors in a trusted execution environment; then, the local deployed micro-model is used to calculate the anomaly confidence level, and local rate limiting or blocking is triggered when the confidence level exceeds the threshold. The behavior embedding vector generation process includes: For time-series log data, a time-series transformer model is used for encoding. For call chain and process tree structure data, a graph torrent algorithm is used for encoding. The self-supervised learning model generates representation vectors with generalization capabilities through contrastive learning techniques.

4. The defense method according to claim 1, characterized in that, The construction of a hierarchical federated architecture, including tenant local nodes, regional clouds, and a global control plane, involves generating a global cross-tenant attack identification model by encrypting and aggregating parameters, and distributing it to each tenant, all while ensuring that log data does not leave the domain. Specifically, this includes: Construct a hierarchical federated learning architecture that includes tenant local nodes, regional cloud aggregators, and global control plane aggregators; while keeping the original log data from leaving the domain, use a secure encrypted aggregation protocol to aggregate the encrypted gradients or model parameters uploaded by each tenant layer by layer, generate a global model with cross-tenant attack pattern recognition capabilities, and distribute the updated global model to each tenant. The hierarchical federated learning architecture also includes a split learning mechanism: For data containing sensitive features, the model is split into a front-end network and a back-end network. The tenant only trains and uploads the activation values ​​of the intermediate layers of the front-end network of the model. These intermediate layer activation values ​​are mathematically irreversible and cannot be restored to the original input data. The control plane is responsible for training the model's backend network.

5. The defense method according to claim 4, characterized in that, The secure encryption aggregation protocol specifically includes: Tenant nodes encrypt the gradients and upload them to the regional aggregator. The regional aggregator calculates the regional model and uploads it to the global aggregator for aggregation. The aggregation process of the global aggregator adopts a secure multi-party computation protocol to ensure that no single-point aggregator can parse the plaintext gradient value of a single tenant. Furthermore, all weight update operations are recorded in a chained hash log for auditing purposes.

6. The defense method according to claim 2, characterized in that, The method constructs a causal attack graph containing entities and event nodes based on multi-tenant behavior embedding and event sequence relationships. Through causal inference and graph transformer reasoning, it outputs the propagation risk probability, root causes, and hub nodes, specifically including: Construct a causal attack graph and perform graph transformer inference; based on the behavior embedding vectors of multi-tenants and the temporal relationship of events, construct a causal attack graph containing entity nodes and event nodes; use causal inference methods to identify causal edges between events, and use the graph transformer model to infer the attack graph, outputting the propagation risk probability of each node and the root cause node and hub node in the attack chain. The method of identifying causal edges between events using causal inference specifically includes: By comprehensively utilizing Granger causality tests, time-point processes, and structural causality models, and based on the temporal sequence of events, behavioral similarities, and contextual environment, it is determined whether the first event is a potential cause of the second event, and directional causal edges are established in the causal attack graph. The unified score is obtained by weighting the matching degree of local anomalies, global models, propagation risks, and threat intelligence. This score is then dynamically adjusted based on the tenant's business criticality and attack posture. Specifically, this includes: In response to the integration of local anomaly detection scores, global model scores, propagation risk values ​​derived from causal graphs, and threat intelligence matching degrees, a unified threat score is generated through weighted calculation; and the alarm threshold used to determine the threat level is dynamically adjusted based on the business criticality in the tenant profile and the current overall attack situation.

7. The defense method according to claim 1, characterized in that, The aforementioned high-level defense intent is synthesized into a cross-cloud execution plan, which, after formal verification, does not violate the tenant's service level agreement. Defense actions are executed in transaction mode, and reversible actions are coupled with compensatory rollbacks to restore the system. Specifically, this includes: Based on automatically synthesizing high-level defense intentions into specific cross-cloud execution plans, and using formal verification methods to verify whether the execution plan violates the tenant's service level agreement before execution; the defense actions in the execution plan are executed in transaction mode, and corresponding compensation rollback operations are configured for each reversible action to support the recovery of system state in case of misjudgment or abnormality; The step of verifying whether the execution plan violates the tenant's service level agreement using formal verification methods before execution specifically includes: Using a satisfiability model theory solver or bounded model checking technique, verify whether the system state after the execution plan is implemented meets the minimum service replica limit, service reachability requirements, and business continuity threshold set in the tenant profile; The execution of the defensive actions in the execution plan is carried out in transaction mode, and corresponding compensation rollback operations are configured for each reversible action. Specifically, this includes: The transaction mode is executed using a compensatory transaction mechanism. The execution plan is broken down into a series of ordered sub-operations, including blocking traffic, restricting access, generating snapshots, and isolating containers; If any sub-operation fails or a rollback instruction is received, the system automatically triggers the corresponding compensation operation to roll back the environment state to the state before the sub-operation was executed.

8. A multi-tenant adaptive collaborative defense system for hybrid cloud scenarios, applied to the multi-tenant adaptive collaborative defense method for hybrid cloud scenarios as described in any one of claims 1-7, characterized in that, include: The Trusted Profiling Module is configured to perform hardware-based remote trust verification on each tenant's agent or connector, and grant the corresponding trusted execution node tag after verifying the trustworthiness of its runtime environment and code integrity; at the same time, it automatically detects the tenant's cloud platform type, interface permissions and resource restrictions, and generates a machine-readable tenant profile that includes business criticality, maximum acceptable damage threshold and automatic response level. The local anomaly detection module is configured to collect multimodal log data locally on the tenant's premises, encode the log data into behavior embedding vectors using a self-supervised learning model, and perform differential privacy noise addition or secure quantization compression processing on the behavior embedding vectors within a trusted execution environment. Then, the local deployed micro-model is used to calculate the anomaly confidence level, and local rate limiting or blocking is triggered when the confidence level exceeds the threshold. The federated aggregation module is configured to build a hierarchical federated learning architecture that includes tenant local nodes, regional cloud aggregators, and global control plane aggregators. While keeping the original log data from leaving the domain, it uses a secure encrypted aggregation protocol to aggregate the encrypted gradients or model parameters uploaded by each tenant layer by layer, generate a global model with cross-tenant attack pattern recognition capabilities, and distribute the updated global model to each tenant. The graph reasoning module is configured to construct a causal attack graph and perform graph transformer reasoning; based on the behavior embedding vectors of multi-tenants and the event sequence relationship, a causal attack graph containing entity nodes and event nodes is constructed; causal inference methods are used to identify causal edges between events, and the attack graph is reasoned through the graph transformer model to output the propagation risk probability of each node and the root cause node and hub node in the attack chain. The scoring and threshold adjustment module is configured to generate a unified threat score by weighted calculation in response to the fusion of local anomaly detection score, global model score, propagation risk value derived from causal graph inference, and threat intelligence matching degree; and dynamically adjust the alarm threshold used to determine the threat level based on the business criticality in the tenant profile and the current overall attack situation. The verification and rollback module is configured to automatically synthesize high-level defense intentions into specific cross-cloud execution plans, and to verify whether the execution plan violates the tenant's service level agreement using formal verification methods before execution; to execute the defense actions in the execution plan in transaction mode, and to configure corresponding compensation rollback operations for each reversible action to support the recovery of the system state in case of misjudgment or abnormality.

9. An electronic device, characterized in that, It includes a processor, a memory, and a communication interface. The memory stores a computer program. When the processor executes the computer program, it implements the multi-tenant adaptive collaborative defense method in a hybrid cloud scenario as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the multi-tenant adaptive collaborative defense method in a hybrid cloud scenario as described in any one of claims 1 to 7.

Images