Network security protection method and system applied to cloud data monitoring

Abstract

The invention provides a network security protection method and system applied to cloud data monitoring, and relates to the technical field of network security, and the method comprises the steps: firstly obtaining a cloud interaction behavior chain set and a transmission metadata set; hierarchically and dynamically disassembling the interaction behavior chain set, and generating a behavior node and transmission metadata association group in combination with a transmission time sequence; performing time sequence abnormity tracing on the behavior node and the transmission metadata association group to obtain an abnormity tracing result; calling a cloud security rule generation library based on the abnormal traceability result to generate a hierarchical targeted protection rule; and converting the hierarchical targeted protection rule into an execution instruction, and sending the execution instruction to a cloud protection execution module to execute protection operation. According to the invention, data can be comprehensively acquired, deep correlation analysis is realized, a targeted protection rule is dynamically generated, and the network security protection capability of cloud data monitoring is effectively improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically, to a network security protection method and system for cloud data monitoring. Background Technology

[0002] In today's digital age, cloud-based data monitoring is widely used in numerous fields, such as enterprise data management and internet services, playing a crucial role in ensuring data security and stable operation. However, with the increasing complexity and diversification of cyberattack methods, cloud-based data monitoring faces many severe cybersecurity challenges.

[0003] Existing cloud-based data monitoring and cybersecurity protection methods have several shortcomings. Firstly, traditional methods often focus on a single dimension of data when acquiring cloud-based data monitoring information, such as only acquiring interaction behavior data or transmission metadata. This makes it difficult to comprehensively and accurately grasp the complete picture of cloud data interactions and effectively identify potential security threats. Secondly, the acquired data lacks effective integration and analysis mechanisms, failing to deeply correlate interaction behavior with transmission metadata, resulting in difficulty in accurately locating the source of problems when anomalies are detected. Furthermore, the generation methods of traditional protection rules are relatively fixed and singular, usually based on preset general rules. They cannot dynamically generate targeted protection rules based on actual detected anomalies, making it difficult to cope with constantly evolving network attack methods and significantly reducing the effectiveness of cloud-based data monitoring and cybersecurity protection. Summary of the Invention

[0004] In view of the aforementioned problems, and in conjunction with the first aspect of the present invention, embodiments of the present invention provide a network security protection method for cloud data monitoring, the method comprising: The cloud interaction behavior chain set and the transmission metadata set generated during the cloud data monitoring process are obtained. The cloud interaction behavior chain set includes a sequence of behavior nodes formed by multiple continuous cloud data interactions and node interaction timing information. The transmission metadata set includes the initiation identifier, receiving identifier, content identifier and transmission timing information corresponding to each interaction behavior. The set of cloud-based interactive behavior chains is dynamically decomposed in layers. Combined with the transmission time sequence information of the transmission metadata set, a behavior node and transmission metadata association group is generated. The behavior node and transmission metadata association group includes the decomposed behavior node and the associated transmission metadata. The behavior nodes and the associated data transmission metadata are used to perform time-series anomaly tracing, identify abnormal behavior nodes and associated abnormal data transmission metadata, and generate anomaly tracing results. The anomaly tracing results include anomaly initiation nodes, anomaly propagation node sequences, abnormal data transmission metadata features, and time-series association relationships. Based on the anomaly tracing results, the cloud security rule generation library is invoked to generate hierarchical targeted protection rules. The hierarchical targeted protection rules include access control rules for the anomaly initiation node, interaction interception rules for the anomaly propagation node sequence, and data filtering rules for the characteristics of the anomaly transmitted metadata. The hierarchical targeted protection rules are converted into cloud protection execution instructions and sent to the cloud protection execution module. The cloud protection execution module is then activated to perform cloud data security protection operations according to the hierarchical targeted protection rules.

[0005] Furthermore, embodiments of the present invention also provide a network security protection system for cloud data monitoring, characterized in that it includes: A processor; a machine-readable storage medium for storing machine-executable instructions of the processor; wherein the processor is configured to execute the aforementioned network security protection method for cloud data monitoring by executing the machine-executable instructions.

[0006] In another aspect, embodiments of the present invention also provide a computer program product, the computer program product including machine-executable instructions, the machine-executable instructions being stored in a computer-readable storage medium, a processor of a network security protection system for cloud data monitoring reading the machine-executable instructions from the computer-readable storage medium, the processor executing the machine-executable instructions, causing the network security protection system for cloud data monitoring to perform the aforementioned network security protection method for cloud data monitoring.

[0007] Based on the above, by acquiring the cloud interaction behavior chain set and transmission metadata set, a comprehensive range of key information generated during cloud data monitoring is achieved. Then, the cloud interaction behavior chain set is dynamically decomposed in layers and combined with transmission time sequence information to generate association groups of behavior nodes and transmission metadata. This achieves deep integration of interaction behavior and transmission metadata, more accurately reflecting the actual situation of cloud data interaction and effectively improving the accuracy of anomaly detection. Time-series anomaly tracing of the association groups accurately identifies abnormal behavior nodes and associated abnormal transmission metadata, generating detailed anomaly tracing results. Based on these results, a cloud security rule generation library is invoked to generate hierarchical targeted protection rules. These rules dynamically generate highly targeted protection rules based on different anomaly situations, including access control, interaction interception, and data filtering rules, achieving comprehensive and multi-layered network security protection. Finally, the protection rules are converted into execution instructions and sent to the cloud protection execution module, ensuring accurate and timely execution of protection operations and effectively improving the network security protection capabilities of cloud data monitoring. Attached Figure Description

[0008] Figure 1This is a schematic diagram of the execution flow of a network security protection method for cloud data monitoring provided in an embodiment of the present invention.

[0009] Figure 2 This is a schematic diagram of exemplary hardware and software components of a network security protection system for cloud data monitoring provided in an embodiment of the present invention. Detailed Implementation

[0010] The present invention will now be described in detail with reference to the accompanying drawings. Figure 1 This is a flowchart illustrating a network security protection method for cloud data monitoring provided in one embodiment of the present invention. The following is a detailed description of this network security protection method for cloud data monitoring.

[0011] Step S110: Obtain the set of cloud interaction behavior chains and the set of transmission metadata generated during the cloud data monitoring process. The set of cloud interaction behavior chains includes a sequence of behavior nodes formed by multiple continuous cloud data interactions and node interaction timing information. The set of transmission metadata includes the initiation identifier, receiving identifier, content identifier and transmission timing information corresponding to each interaction behavior.

[0012] In this embodiment, the daily data interaction monitoring of an enterprise cloud office system is used as the application scenario. First, by deploying traffic acquisition probes on each server node of the cloud office system, all data interaction behaviors within the system are captured in real time. These interaction behaviors form a continuous sequence of behavior nodes. For example, when an employee terminal device initiates a file upload request to a file server, it is forwarded by a load balancer and finally reaches the file storage server. The employee terminal device node, the load balancer node, and the file storage server node in this process constitute a sequence of behavior nodes in an interaction chain. At the same time, each node records the timestamp of the interaction during the interaction process. These timestamps are arranged in chronological order to form node interaction timing information. For example, if the employee terminal device initiates a request at 09:00:00, the load balancer server receives and forwards the request at 09:00:01, and the file storage server receives the request at 09:00:02, this time information together constitutes the node interaction timing information of this interaction chain. For the transmission metadata set, when an employee's terminal device uploads a file named "Project Plan.docx", the initiator can be the MAC address of the employee's terminal device, the receiver can be the IP address of the file storage server, the content identifier can be the hash value of the file, and the transmission timing information records the time interval from 09:00:00 to 09:00:10. Through the above method, the cloud-based interaction behavior chain set and transmission metadata set corresponding to all interactive behaviors are continuously collected and aggregated.

[0013] Step S120: The cloud-based interactive behavior chain set is dynamically decomposed in layers, and the behavior node and transmission metadata association group is generated by combining the transmission time sequence information of the transmission metadata set. The behavior node and transmission metadata association group includes the decomposed behavior node and the associated transmission metadata.

[0014] In the aforementioned enterprise cloud-based office system scenario, after obtaining the set of cloud-based interactive behavior chains and the set of transmission metadata, they need to be processed to establish the association between behavior nodes and transmission metadata. For example, if a certain interactive behavior chain involves an employee's terminal accessing a database server through an intermediate proxy server to obtain customer information, it is necessary to break it down according to the interaction level and associate it with the corresponding transmission metadata.

[0015] Step S121: Divide each segment of the cloud-based interactive behavior chain set into an initiation layer, a forwarding layer, and a receiving layer according to the interaction level. The initiation layer contains interactive initiation nodes, the forwarding layer contains interactive forwarding nodes, and the receiving layer contains interactive receiving nodes.

[0016] For the above-mentioned interaction chain of employee terminals accessing the database server, the initiating layer is the layer where the employee's terminal device is located, and the interaction initiating node in this layer is the office computer used by the employee; the forwarding layer is the layer where the intermediate proxy server is located, and the interaction forwarding node in this layer is the proxy server; the receiving layer is the layer where the database server is located, and the interaction receiving node is the database server. Through the above division, the node layers with different functions in the interaction chain can be separated.

[0017] Step S122: Extract attributes from the behavior nodes at each level to obtain the attributes of the initiating layer node, the forwarding layer node, and the receiving layer node. The attributes of the initiating layer node include the initiating node identifier, the initiating service type, and the initiating permission scope. The attributes of the forwarding layer node include the forwarding node identifier, the forwarding path information, and the forwarding resource usage. The attributes of the receiving layer node include the receiving node identifier, the receiving service type, and the receiving data processing capability.

[0018] For each layer of nodes, their attributes are further extracted. For employee office computers at the initiating layer, the node attribute extraction module connects to the cloud node management database to obtain the computer's registration information. A unique hardware identifier, such as the computer's serial number, is extracted as the initiating node identifier. Based on the office software installed on the computer and the system services accessed, the initiating service type is determined to be office data access service. The initiating permission scope is set according to the employee's job position permissions; for example, ordinary employees can only access public project materials, while department managers can access departmental project materials. For proxy servers at the forwarding layer, a unique device number is extracted from the path record information in the cloud node management database as the forwarding node identifier. The sequence of other server IP addresses traversed by the server during forwarding is obtained as forwarding path information. Simultaneously, data such as CPU usage and memory usage during forwarding are collected as forwarding resource usage attributes. For database servers at the receiving layer, the receiving node identifier is the service ID assigned by the database system, the receiving service type is relational database service, and the receiving data processing capacity is obtained by querying the database configuration information, including indicators such as maximum query processing times per second and maximum concurrent connections.

[0019] Step S1221: Call the node attribute extraction module, connect to the cloud node management database, and obtain the registration information of the initiating layer behavior node in the cloud node management database.

[0020] When extracting attributes from the initiating layer node, the node attribute extraction module establishes a communication connection with the cloud-based node management database through a pre-defined database connection interface. This connection employs an encrypted transmission protocol to ensure the security of data transmission. After a successful connection, the module queries the registration information table in the database based on the temporary device identifier of the initiating layer behavior node to obtain the node's complete registration record, including detailed information such as device model, operating system version, and installed software list.

[0021] Step S1222: Extract the unique identifier of the initiating layer behavior node from the registration information as the initiating node identifier, extract the cloud service category to which the initiating node belongs as the initiating service type, and extract the authorized operation scope of the initiating node as the initiating permission scope.

[0022] From the obtained registration information of the initiating behavior nodes, unique fields are selected as the initiating node identifiers, such as the device's UUID. Based on the services the node primarily provides or accesses, its cloud service category is determined. For example, if the node primarily accesses file storage services, the initiating service type is "File Storage Access Service." The initiating permission scope is extracted from the permission configuration field in the registration information. This field details the operations the node is allowed to perform, such as the permission scope for reading, modifying, and deleting files.

[0023] Step S1223: Standardize the format of the initiating permission scope, convert the permission scope description into a unified permission code sequence, so that the permission scope expression of different initiating nodes is consistent.

[0024] Because the permission scope descriptions of different initiating nodes may have different formats—for example, some nodes might describe permission as "Allow reading all public files, prohibit modification," while others might describe it as "read: public, write: no"—standardization is required. A permission code mapping table is established to convert various permission descriptions into corresponding codes, such as "Read public files" corresponding to code "R-PUB," and "Prohibit modification" corresponding to code "WN." Through this conversion, the permission scope of all initiating nodes is uniformly represented as a permission code sequence similar to "R-PUB, WN," facilitating subsequent attribute comparison and analysis.

[0025] Step S1224: Obtain the path record information of the forwarding layer behavior node in the cloud node management database, extract the unique identifier of the forwarding layer behavior node as the forwarding node identifier, extract the node sequence that the forwarding node passes through during the interaction as the forwarding path information, and extract the computing resources and storage resources occupied by the forwarding node during the interaction as the forwarding resource occupancy.

[0026] For forwarding layer behavior nodes, their historical forwarding path data is retrieved from the path record information table in the cloud node management database. The unique device number of the node is extracted as the forwarding node identifier. The IP addresses of each node traversed in sequence during the forwarding process are arranged in order to form the forwarding path information, such as "192.168.1.10→192.168.1.11→192.168.1.12". At the same time, the computing resource data such as CPU utilization, memory usage, and network bandwidth usage of the forwarding node during the interaction period, as well as storage resource data such as temporary cache file size, are obtained from the resource monitoring table of the database. The above data is integrated into the forwarding resource usage attribute.

[0027] Step S1225: Organize the forwarding path information into a sequence, arrange the node sequence according to the forwarding order, add a path location identifier to each node, and mark the order of the nodes in the forwarding path.

[0028] After obtaining the node sequence of forwarding path information, it is rearranged according to the actual forwarding order to ensure that the sequence order is consistent with the order in which the data flows through the nodes. Then, a path position identifier is added to each node, such as marking the first node as "P1", the second as "P2", and so on, to clarify the position of each node in the forwarding path. For example, the original node sequence may be disordered due to database storage order issues. After being sorted and marked with position identifiers, the sequence is "P1: 192.168.1.10, P2: 192.168.1.11, P3: 192.168.1.12".

[0029] Step S1226: Obtain the capability configuration information of the receiving layer behavior node in the cloud node management database, extract the unique identifier of the receiving layer behavior node as the receiving node identifier, extract the cloud service category to which the receiving node belongs as the receiving service type, and extract the maximum data processing rate and data storage capacity of the receiving node as the receiving data processing capability.

[0030] Access the configuration table of the cloud node management database to obtain the configuration information of the receiving layer behavior nodes. The receiving node identifier can be a combination of the node's service port number and IP address, such as "192.168.1.20:8080". Based on the core service functions provided by the node, determine the receiving service type; for example, a node providing web services will receive web application services. Regarding data processing capabilities, extract the maximum data processing rate from the configuration information, such as the number of requests per second, as well as the node's total storage capacity and available storage capacity, to comprehensively represent the receiving node's data processing capabilities.

[0031] Step S1227: Retrieve the attribute information of the corresponding node from the cloud node management database and replace the attribute data that is inconsistent with the original record.

[0032] To ensure the accuracy of the extracted attribute information, after the initial attribute extraction, the system reconnects to the cloud node management database to perform a second query and verification of the node attribute information at each level. The attribute data extracted in the first query is compared with the original records retrieved in the second query. If any inconsistencies are found, such as a discrepancy between the CPU utilization rate in the initially extracted forwarding resource usage and the latest record in the database, the original record in the database is used to replace the inconsistent attribute data, thus ensuring the authenticity and reliability of the attribute information.

[0033] Step S1228: Store the initiating layer node attributes, forwarding layer node attributes, and receiving layer node attributes that are finally consistent with the original record according to the hierarchy, forming a hierarchy-node attribute correspondence table.

[0034] After verification and correction, the attributes of nodes at each level are stored in the attribute database of the cloud security analysis platform, categorized by initiating layer, forwarding layer, and receiving layer. Simultaneously, a mapping table between levels and node attributes is generated. This table, indexed by level name, associates the attribute information of all nodes under the corresponding level, facilitating quick querying and retrieval of node attributes at each level during subsequent matching of behavioral nodes with transmitted metadata.

[0035] Step S123: Extract the transmission timing information of each segment of transmission metadata in the transmission metadata set, establish the timing correspondence between the transmission timing information and the interaction behavior chain, so that each segment of transmission metadata can be matched with the corresponding timing interaction behavior chain.

[0036] In enterprise cloud-based office systems, the transmission sequence information of metadata includes the start time, end time, and key time points during the transmission process. For example, when a file is transferred from an employee's terminal to a file server, the transmission sequence information records that the transmission started at 09:00:00 and ended at 09:00:10, with the file header information being transmitted at 09:00:05. For interaction chains, the node interaction sequence information records the time each node participates in the interaction. By comparing the start time of the transmission sequence information with the interaction start time of the initiating node in the interaction chain, and the end time of the transmission sequence information with the interaction end time of the receiving node in the interaction chain, a temporal correspondence is established between the two. For example, if the transmission start time 09:00:00 is the same as the interaction start time 09:00:00 of an initiating node in a certain interaction chain, and the transmission end time 09:00:10 is the same as the interaction end time 09:00:10 of the receiving node in the same interaction chain, then it can be determined that this transmission metadata matches that interaction chain. In cases where multiple interaction behavior chains overlap in time, the key time points in the transmission process are further combined with the interaction time points of each node in the interaction behavior chain for precise matching, ensuring that each segment of transmitted metadata accurately corresponds to a unique interaction behavior chain.

[0037] Step S124: Match the behavior nodes and transmission metadata according to the interaction level. Match the initiating layer behavior nodes with the transmission metadata containing the initiating identifier, the forwarding layer behavior nodes with the transmission metadata containing the forwarding path information, and the receiving layer behavior nodes with the transmission metadata containing the receiving identifier.

[0038] Based on the established hierarchy and node attribute mapping table, the initiating node identifier of an initiating layer behavior node will exist in the transmission metadata as an initiating identifier. For example, the MAC address of an employee terminal serves as the initiating node identifier, and this MAC address is also recorded in the initiating identifier field of the transmission metadata. Therefore, the initiating layer behavior node can be matched with the transmission metadata containing this MAC address. For forwarding layer behavior nodes, their forwarding path information includes the sequence of node IP addresses traversed during forwarding, and the transmission metadata also records the path information traversed by the data transmission. By comparing the path information sequences of the two, the forwarding layer behavior node is matched with the corresponding transmission metadata. The receiving node identifier of a receiving layer behavior node, such as the IP address of a database server, will appear in the receiving identifier field of the transmission metadata. Based on this, the receiving layer behavior node is matched with the transmission metadata containing this IP address. During the matching process, if a behavior node corresponds to multiple transmission metadata or a transmission metadata corresponds to multiple behavior nodes, further precise filtering is performed by combining node interaction timing information and transmission timing information to ensure the uniqueness of the match.

[0039] Step S125: Packetize the matched behavior nodes and transmission metadata to form initial association groups. Each initial association group contains a single-level behavior node and associated transmission metadata.

[0040] After matching the behavioral nodes with the transmission metadata, the successfully matched behavioral nodes and their corresponding transmission metadata at each level are combined into a data unit, namely the initial association group. For example, the employee terminal device node at the initiating layer is combined with the transmission metadata containing the terminal's MAC address to form the initiating layer initial association group. This initial association group contains behavioral node attributes such as the employee terminal's initiating node identifier, initiating service type, and initiating permission scope, as well as content from the transmission metadata such as initiating identifier, receiving identifier, content identifier, and transmission timing information. Similarly, the forwarding layer and the receiving layer also form their own initial association groups, each containing behavioral node information for a single level and its associated transmission metadata information.

[0041] Step S126: Adjust the timing order of the initial association groups according to the node interaction timing information of the interaction behavior chain, so that the arrangement order of the initial association groups is consistent with the occurrence order of the interaction behaviors.

[0042] The timing information of node interactions in the interaction chain reflects the chronological order of the interactions. For example, in the interaction between an employee terminal and a database server, the initiating layer node initiates the interaction first, then the forwarding layer node forwards it, and finally the receiving layer node receives and processes the request. Therefore, the corresponding initial association groups should also be arranged in the order of initiating layer, forwarding layer, and receiving layer. By reading the interaction timestamps of each node in the interaction chain, the chronological order of nodes at each level in the interaction process is determined, and then the order of the initial association groups is adjusted accordingly. For example, the initial association group of the initiating layer has the earliest interaction timestamp and is placed first, followed by the initial association group of the forwarding layer, and then the initial association group of the receiving layer is placed last, ensuring that the timing order of the initial association groups matches the actual order of the interaction behaviors.

[0043] Step S127: Supplement the attributes of the initial association groups after time-series adjustment. If any initial association group is missing a behavior node attribute, extract the attribute information of the corresponding level behavior node and add it. If the transmission metadata feature is missing, match the transmission metadata in the corresponding transmission metadata set and add it.

[0044] During the timing adjustment process, it may be discovered that some initial association groups have missing behavioral node attributes or incomplete transmission metadata features due to omissions or errors during data collection. For example, if an initial association group at the initiation layer lacks an initiation permission scope attribute, it is necessary to re-call the node attribute extraction module, connect to the cloud node management database, extract the initiation permission scope attribute of the behavioral node at the initiation layer, and add it to the association group. If an initial association group at the forwarding layer lacks content identifier features in the transmission metadata, then based on the forwarding path information and transmission timing information of the association group, a matching transmission metadata is searched again in the transmission metadata set, the content identifier features are extracted, and added to the association group to ensure the information integrity of each initial association group.

[0045] Step S128: The supplemented initial association groups are grouped according to the segment identifier of the interaction behavior chain. Each group contains the initiating layer, forwarding layer, and receiving layer association groups after the same segment of the interaction behavior chain is broken down.

[0046] Each segment of the cloud-based interactive behavior chain set has a unique segment identifier, such as an interactive behavior chain ID. After completing the timing adjustment and attribute supplementation of the initial association groups, the initial association groups of the initiating layer, forwarding layer, and receiving layer belonging to the same interactive behavior chain are grouped into the same group based on the segment identifier of the interactive behavior chain to which each initial association group belongs. For example, the interactive behavior chain with the segment identifier "ICL-001" will have its initiating layer initial association group, forwarding layer initial association group, and receiving layer initial association group divided into the same group, forming a complete interactive behavior chain association group set, which facilitates subsequent anomaly analysis of the entire interactive behavior chain.

[0047] Step S129: Add a time sequence label to each associated group. The time sequence label includes the start time, duration and end time of the interaction behavior.

[0048] For each association group, the start time, duration, and end time of the entire interaction are determined based on the transmission timing information of each initial association group and the node interaction timing information contained within it. The start time is the transmission start time of the initiating layer's initial association group, the end time is the transmission end time of the receiving layer's initial association group, and the duration is calculated by subtracting the start time from the end time. This time information is integrated into a timing tag and added to the corresponding association group. For example, the timing tag for an association group might be "Start Time: 09:00:00, Duration: 00:00:10, End Time: 09:00:10," giving each association group a clear time attribute.

[0049] Step S1210: Determine the association group with the time sequence label as the final association group of behavior node and transmission metadata, so that each association group of behavior node and transmission metadata contains complete behavior node attributes, transmission metadata and time sequence label.

[0050] After all the above processing steps, the association group with time-series tags contains the attributes of each level of behavioral nodes, the associated transmission metadata, and the time-series tags, with complete information and a clear structure. At this point, the above association group is officially identified as the behavioral node and transmission metadata association group and stored in the association database of the cloud security analysis platform as the basic data for subsequent time-series anomaly tracing.

[0051] Step S130: Perform time-series anomaly tracing on the behavior node and the associated transmission metadata group, identify abnormal behavior nodes and associated abnormal transmission metadata, and generate anomaly tracing results. The anomaly tracing results include anomaly starting nodes, anomaly propagation node sequences, abnormal transmission metadata features, and time-series association relationships.

[0052] In enterprise cloud-based office systems, once a behavior node and its associated metadata are linked, it's necessary to trace any temporal anomalies. For example, a linking group might record the interaction process of an employee's terminal accessing a database server through a proxy server. By analyzing this linking group and other related links, it's possible to determine if any abnormal behavior exists.

[0053] Step S131: Extract the time sequence labels of all behavior nodes and transmission metadata association groups, sort the association groups according to the start time in the time sequence labels, and form a time sequence association group sequence.

[0054] The system reads the time sequence tags of all behavior nodes and their associated metadata groups from the correlation database of the cloud security analytics platform, extracting the start time information. All association groups are then sorted in ascending order according to their start times; for example, the association group with a start time of 09:00:00 is placed at the beginning, followed by the association group with a start time of 09:00:05, and so on, forming a time-series association group sequence. This sequence can demonstrate the chronological order of various interactive behaviors within the enterprise's cloud-based office system.

[0055] Step S132: For each association group in the time-series association group sequence, extract the attribute features of the behavior nodes and the features of the transmission metadata. The attribute features include node identifier, service type, and permission scope. The transmission metadata features include initiator identifier, receiver identifier, content identifier, and transmission volume information.

[0056] Taking a specific association group in the time-series association group sequence as an example, this association group corresponds to the interaction behavior of an employee terminal accessing a database server. When extracting the attribute features of the behavior node, the node identifier is the employee terminal's UUID, the service type is database access service, and the permission scope is the standardized permission code sequence "R-PUB, WN". For the transmission metadata features, the initiator identifier is the employee terminal's MAC address, the receiver identifier is the database server's IP address, the content identifier is the accessed database table name and the hash value of the query conditions, and the transmission volume information includes the query request data volume and the returned result data volume. By performing the above feature extraction on each association group in the time-series association group sequence, a series of attribute features and transmission metadata features are obtained.

[0057] Step S133: Establish a time-series anomaly judgment benchmark, which is derived from the statistical analysis of the characteristics of related groups with no historical abnormal interactions, including the normal range of behavioral node attributes and the normal range of transmission metadata characteristics.

[0058] We collected characteristic data of related groups corresponding to all interaction behaviors marked as normal within the past three months of the enterprise's cloud-based office system. This data came from interaction records in the cloud security logs that had been manually reviewed and confirmed to be risk-free. For the permission range in the behavior node attributes, we statistically analyzed common permission code sequences for nodes under different service types to determine the normal range for the permission range corresponding to each service type. For example, the normal range for the permission range of the database access service includes code sequences such as "R-PUB" and "R-DEP" (department data read permission). Regarding transmission metadata characteristics, for different combinations of initiating and receiving identifiers, we statistically analyzed the distribution of content identifier types and the fluctuation range of transmission volume information in historical interactions. For example, in normal interactions between employee terminals and the database server, content identifiers are mostly customer data tables, project progress tables, etc., and transmission volume information typically fluctuates between 1KB and 10MB. These statistical results were determined as the normal range for transmission metadata characteristics, collectively forming the benchmark for judging time-series anomalies.

[0059] Step S134: Compare the current associated group's behavior node attribute features with the normal range of behavior node attributes. If the current behavior node attribute features exceed the normal range of behavior node attributes, then mark the behavior node as a suspected abnormal node.

[0060] In the time-series association group sequence, each association group is selected sequentially as the current association group for analysis. For example, in the behavioral node attribute characteristics of the current association group, the service type is database access service, and the permission range code sequence is "R-ALL, W-ALL" (read all, write all permissions). However, according to the time-series anomaly judgment benchmark, the normal range of database access service permissions for ordinary employees does not include "R-ALL, W-ALL". In this case, the current behavioral node attribute characteristics exceed the normal range, so this behavioral node is marked as a suspected abnormal node.

[0061] Step S135: Compare the transmission metadata characteristics of the current associated group with the normal range of transmission metadata characteristics. If the current transmission metadata characteristics exceed the normal range of transmission metadata characteristics, mark the transmission metadata as suspected abnormal transmission metadata.

[0062] Taking the current associated group as an example, the database table corresponding to the content identifier in its transmitted metadata characteristics is the "salary table." However, according to the time-series anomaly judgment criteria, in normal interactions between ordinary employee terminals and database servers, the content identifier almost never involves the "salary table." Furthermore, the transmitted data volume reaches 50MB, far exceeding the normal fluctuation range of 1KB to 10MB. Therefore, the current transmitted metadata characteristics exceed the normal range, and this transmitted metadata is marked as suspected abnormal transmitted metadata.

[0063] Step S136: Perform time-series correlation analysis on the marked suspected abnormal nodes and suspected abnormal transmission metadata to determine whether the suspected abnormal nodes and suspected abnormal transmission metadata belong to the same time-series correlation group. If they belong to the same group, they are identified as an abnormal correlation group.

[0064] After identifying suspected anomalous nodes and suspected anomalous transmission metadata, the association group IDs of both are queried to determine if they belong to the same temporal association group. If the association group IDs of both the suspected anomalous node and the suspected anomalous transmission metadata are "AG-123", then they belong to the same temporal association group, and this association group is identified as an anomalous association group. If they belong to different association groups, further analysis is needed to determine if there is an indirect temporal or node association relationship between them. If no such relationship exists, their corresponding association groups are not marked as anomalous association groups for the time being.

[0065] Step S137: Starting from the abnormal association group, trace backward along the temporal association group sequence to find the subsequent association group that has node interaction relationship with the abnormal association group, and extract the behavior nodes and transmission metadata in the subsequent association group.

[0066] After identifying the abnormal association group, starting from its position in the time-series association group sequence, traverse the other association groups in the sequence. By comparing the association relationship between the behavior node identifiers of each subsequent association group and the behavior node identifiers in the abnormal association group, find subsequent association groups with node interaction relationships. For example, if the suspected abnormal node in the abnormal association group is employee terminal A, and the initiating node identifier in a subsequent association group is also employee terminal A, and the service type is file upload service, then this subsequent association group has a node interaction relationship with the abnormal association group (same initiating node). Extract the behavior nodes in this subsequent group, including attribute features such as node identifier, service type, and permission scope, as well as features such as the initiating identifier, receiving identifier, content identifier, and transmission volume information of the transmitted metadata.

[0067] Step S138: Compare the attribute similarity between the behavior nodes in the subsequent association group and the suspected abnormal nodes in the abnormal association group, and compare the feature similarity between the transmission metadata in the subsequent association group and the suspected abnormal transmission metadata in the abnormal association group.

[0068] For the subsequent associated groups found, it is necessary to compare the attribute similarity between their behavioral nodes and suspected abnormal nodes, as well as the feature similarity between their transmitted metadata and suspected abnormal transmitted metadata.

[0069] Step S1381: Divide the attributes of the behavior nodes in the subsequent association group into identifier attributes, service attributes and permission attributes. The identifier attribute includes the node identifier, the service attribute includes the service type, and the permission attribute includes the permission scope.

[0070] The behavioral nodes in the subsequent association group have rich attributes. To accurately calculate similarity, they are divided into three dimensions: identifier attribute, service attribute, and permission attribute. Among them, the identifier attribute is the unique identifier of the node, such as the UUID of employee terminal A; the service attribute is the service type that the node is currently interacting with, such as the file upload service; and the permission attribute is the permission scope of the node under the service type, such as the permission code sequence "W-PUB" (public file write permission) corresponding to the file upload service.

[0071] Step S1382: Divide the attributes of suspected abnormal nodes in the abnormal association group into identification attributes, service attributes, and permission attributes.

[0072] The attributes of suspected abnormal nodes in the abnormal association group are also divided in the same way: the identification attribute is the UUID of employee terminal A, the service attribute is database access service, and the permission attribute is "R-ALL, W-ALL".

[0073] Step S1383: Calculate the similarity of the identification attributes between the subsequent associated group behavior nodes and the suspected abnormal nodes. If the node identifications are the same, the identification attribute similarity is determined to be the first level according to the preset standard. If the node identifications are different but belong to the same service cluster, the identification attribute similarity is determined to be the second level according to the preset standard. If the node identifications are different and do not belong to the same service cluster, the identification attribute similarity is determined to be the third level according to the preset standard.

[0074] In the preset standards, the first level represents extremely high similarity, the second level represents medium similarity, and the third level represents low similarity. In this example, the node identifiers of the subsequent associated group behavior node and the suspected abnormal node are both the UUID of employee terminal A, therefore the identifier attribute similarity is judged as the first level.

[0075] Step S1384: Calculate the service attribute similarity between the subsequent associated group behavior node and the suspected abnormal node. If the service types of the two are completely identical, the service attribute similarity is determined to be the first level according to the preset standard; if the service types partially overlap, the service attribute similarity is determined to be the second level according to the preset standard; if the service types are completely different, the service attribute similarity is determined to be the third level according to the preset standard.

[0076] The service type of the subsequent associated group behavior node is file upload service, and the service type of the suspected abnormal node is database access service. These two service types are completely different in function and have no overlap. Therefore, the service attribute similarity is judged to level three.

[0077] Step S1385: Calculate the similarity of permission attributes between the subsequent associated group behavior nodes and the suspected abnormal nodes. If the permission ranges of the two completely overlap, the permission attribute similarity is determined to be the first level according to the preset standard; if the permission ranges partially overlap, the permission attribute similarity is determined to be the second level according to the preset standard; if the permission ranges do not overlap, the permission attribute similarity is determined to be the third level according to the preset standard.

[0078] The permission scope of the subsequent associated group behavior node is "W-PUB", and the permission scope of the suspected abnormal node is "R-ALL, W-ALL". The permission scopes of the two overlap, that is, they both contain code related to write permissions. Therefore, the permission attribute similarity is judged to the second level.

[0079] Step S1386: Based on the similarity of identifier attributes, service attributes, and permission attributes, determine the overall attribute similarity between the subsequent associated group behavior nodes and suspected abnormal nodes. The overall attribute similarity level is the lowest of the three.

[0080] In the above calculations, the similarity of the identifier attribute is the first level, the similarity of the service attribute is the third level, and the similarity of the permission attribute is the second level. Following the principle of taking the lowest level, the overall attribute similarity level between the subsequent associated group behavior nodes and the suspected abnormal nodes is the third level.

[0081] Step S1387: Divide the characteristics of the transmitted metadata in the subsequent association group into identification characteristics, content characteristics and transmission volume characteristics. The identification characteristics include the initiating identifier and the receiving identifier, the content characteristics include the content identifier, and the transmission volume characteristics include the transmission volume information.

[0082] The metadata characteristics of subsequent associated groups also need to be analyzed from multiple dimensions, divided into identification characteristics, content characteristics, and transmission volume characteristics. The initiator identifier in the identification characteristics is the MAC address of employee terminal A, and the receiver identifier is the IP address of the file server; the content identifier in the content characteristics is the hash value of the uploaded file; the transmission volume information includes the size of the uploaded file and the transmission rate, constituting the transmission volume characteristics.

[0083] Step S1388: The features of suspected abnormal transmission metadata in the abnormal association group are also divided into identification features, content features and transmission volume features.

[0084] Among the identification features of suspected abnormal transmission metadata, the initiator is identified by the MAC address of employee terminal A, and the receiver is identified by the IP address of the database server; the content feature is identified by the hash value of the query conditions of the "salary table"; the transmission volume feature includes the amount of query request data and the amount of returned result data.

[0085] Step S1389: Calculate the similarity of the identifier features between the metadata transmitted in the subsequent associated group and the metadata transmitted in the suspected abnormal group. If the initiating identifier and the receiving identifier are the same, the similarity of the identifier features is determined to be at the first level according to the preset standard. If only one identifier is the same, the similarity of the identifier features is determined to be at the second level according to the preset standard. If both identifiers are different, the similarity of the identifier features is determined to be at the third level according to the preset standard.

[0086] The initiator identifier of the subsequent associated group's metadata transmission is the same as the initiator identifier of the suspected abnormal metadata transmission (both are the MAC address of employee terminal A), but the receiver identifiers are different (one is the file server IP, and the other is the database server IP). Therefore, the identifier feature similarity is judged to be level two.

[0087] Step S13810: Calculate the content feature similarity between the metadata transmitted in the subsequent association group and the metadata transmitted in the suspected abnormal group. If the content identifiers are the same, the content feature similarity is determined to be at the first level according to the preset standard; if the content identifiers belong to the same category, the content feature similarity is determined to be at the second level according to the preset standard; if the content identifiers belong to different categories, the content feature similarity is determined to be at the third level according to the preset standard.

[0088] The content identifier of the metadata transmitted by the subsequent associated group is the hash value of the uploaded file, which belongs to the file content identifier; the content identifier of the metadata of the suspected abnormal transmission is the hash value of the database query condition, which belongs to the database operation content identifier. The two belong to different categories, so the content feature similarity is judged to the third level.

[0089] Step S13811: Calculate the similarity of transmission volume characteristics between the subsequent associated group transmission metadata and the suspected abnormal transmission metadata. If the transmission volume information is in the same numerical range, the similarity of transmission volume characteristics is determined to be the first level according to the preset standard; if the transmission volume information is in adjacent numerical ranges, the similarity of transmission volume characteristics is determined to be the second level according to the preset standard; if the transmission volume information is in non-adjacent numerical ranges, the similarity of transmission volume characteristics is determined to be the third level according to the preset standard.

[0090] Assuming that in the subsequent associated group's metadata transmission volume information, the uploaded file size is 20MB, which falls within the value range of 10MB-50MB; and in the suspected abnormal metadata transmission volume information, the returned result data size is 50MB, which falls within the value range of 50MB-100MB, these two ranges are adjacent, therefore the transmission volume feature similarity is determined to be at the second level.

[0091] Step S13812: Based on the similarity of identifier features, content features, and transmission volume features, determine the overall feature similarity between the subsequently associated group transmission metadata and the suspected abnormal transmission metadata. The overall feature similarity level is the lowest of the three.

[0092] In this example, the identifier feature similarity is at level two, the content feature similarity is at level three, the transmission volume feature similarity is at level two, and the overall feature similarity level is the lowest level, level three.

[0093] Step S139: If both attribute similarity and feature similarity meet the preset similarity criteria, then the behavior nodes in the subsequent association group are identified as abnormal propagation nodes, and the transmitted metadata is identified as abnormal propagation transmitted metadata.

[0094] The preset similarity standard is that both the overall attribute similarity level and the overall feature similarity level are not lower than the second level. In the example above, the overall attribute similarity level and the overall feature similarity level of the subsequent association group are both at the third level, failing to meet the preset similarity standard. Therefore, the behavioral nodes and transmitted metadata in this subsequent association group are not identified as anomalous propagation nodes and anomalous propagation transmitted metadata. If, in another subsequent association group, the overall attribute similarity level is at the second level and the overall feature similarity level is at the first level, both meeting the preset similarity standard, then the behavioral nodes and transmitted metadata in this subsequent association group are identified as anomalous propagation nodes and anomalous propagation transmitted metadata.

[0095] Step S1310: Identify the suspected abnormal nodes in the abnormal association group as the abnormal starting nodes, arrange the abnormal propagation nodes in chronological order to form an abnormal propagation node sequence, integrate the abnormal starting nodes, the abnormal propagation node sequence, the abnormal transmission metadata features and chronological associations, and generate the abnormal source tracing result.

[0096] After a comprehensive analysis of the temporal correlation group sequence, suspected abnormal nodes in the abnormal correlation group were officially identified as abnormal initiation nodes, such as employee terminal A. All behavioral nodes identified as abnormal propagation nodes were arranged according to their order of appearance in the temporal correlation group sequence, forming an abnormal propagation node sequence, such as employee terminal A → proxy server B → financial server C. Simultaneously, abnormal transmission metadata characteristics corresponding to the abnormal initiation node and abnormal propagation nodes were collected, along with the temporal correlations such as the chronological order and interaction relationships between these nodes and the transmission metadata. This information was then integrated to generate the abnormal source tracing results.

[0097] For example, step S13101: Create a node file for the abnormal starting node, wherein the file content includes the abnormal starting node identifier, the time when the abnormal first occurred, the abnormal attribute characteristics, and the associated abnormal transmission metadata identifier.

[0098] Create a node file for employee terminal A, the node that initiated the anomaly. The identifier for the initiating node is its UUID. The time of the first occurrence of the anomaly is the start time of the anomaly association group, 09:00:00. Anomaly attribute characteristics include a service type of database access service and a permission scope of "R-ALL, W-ALL". The associated anomaly transmission metadata identifier is a unique ID of the transmission metadata in this anomaly association group, such as "MD-001". Record the above information in the node file.

[0099] Step S13102: Create a node file for each node in the abnormal propagation node sequence, wherein the file content includes the abnormal propagation node identifier, the time when the abnormality occurred, the interaction relationship with the previous abnormal node, and the associated abnormal transmission metadata identifier.

[0100] Agent server B in the anomaly propagation node sequence has its anomaly propagation node identifier in its node file as the device UUID. The anomaly occurred at the start time of the associated group to which this node belongs, 09:00:05. The interaction relationship with the preceding anomaly node is described as "receiving a request from employee terminal A and forwarding it to financial server C". The associated anomaly transmission metadata identifier is the transmission metadata ID "MD-002" in the associated group of this node, and so on, creating a detailed file for each anomaly propagation node.

[0101] Step S13103: Arrange the abnormal starting node file and the abnormal propagation node sequence file in the order of the time when the abnormality occurred to form an abnormal node time sequence table.

[0102] Arrange the files of the abnormal starting node employee terminal A (first abnormal time 09:00:00), the abnormal propagation node proxy server B (abnormal time 09:00:05), and the abnormal propagation node financial server C (abnormal time 09:00:10) in chronological order to form an abnormal node time sequence table, which clearly shows the time sequence of the abnormal nodes.

[0103] Step S13104: Extract the features of all abnormal transmission metadata, classify and organize them according to the associated abnormal nodes, and form a correspondence table between abnormal nodes and transmission metadata features. The correspondence table between abnormal nodes and transmission metadata features includes the abnormal node identifier, the initiator identifier, the receiver identifier, the content identifier, and the transmission volume information of the abnormal transmission metadata.

[0104] Collect the characteristics of all abnormal transmission metadata, such as the transmission metadata characteristics associated with the abnormal initiating node, employee terminal A (initiator MAC address, receiver database IP, content identifier "salary table" hash value, transmission volume information 50MB), and the transmission metadata characteristics associated with the abnormal propagation node, proxy server B. Classify these characteristics according to the abnormal node identifier; for example, group the abnormal transmission metadata characteristics belonging to employee terminal A into one category, forming a table mapping abnormal nodes to transmission metadata characteristics, facilitating the query of the transmission metadata characteristics corresponding to each abnormal node.

[0105] Step S13105: Establish a time-series association table, which includes the interaction time and interaction method between the abnormal starting node and the first abnormal propagation node, the interaction time and interaction method between adjacent abnormal propagation nodes, and the association time between the abnormal node and the abnormal transmission metadata.

[0106] In the time-series association table, the interaction time between the anomaly initiation node, employee terminal A, and the first anomaly propagation node, proxy server B, is recorded as 09:00:01, with the interaction method being a TCP connection request. The interaction time between the adjacent anomaly propagation node, proxy server B, and the financial server, C, is 09:00:06, with the interaction method being an HTTP POST request. The association time between the anomaly node, employee terminal A, and the anomaly transmission metadata MD-001 is 09:00:00, which is the start time of the anomaly association group. The table above records the time-series associations between each anomaly element in detail.

[0107] Step S13106: Integrate the abnormal node time series table, the abnormal node and transmission metadata feature correspondence table, and the time series association table to form the basic data framework for abnormal source tracing results.

[0108] The data in the three tables above are linked and integrated. The anomaly node time sequence table provides the time order of anomaly nodes, the anomaly node-transmission metadata feature correspondence table establishes the connection between nodes and transmission metadata, and the time sequence association table supplements the interaction details. For example, in the basic data framework, by using the UUID of the anomaly initiating node, employee terminal A, information such as its anomaly attribute characteristics, associated anomaly transmission metadata characteristics (from the correspondence table), and interaction time and method with proxy server B (from the time sequence association table) can be found, forming a comprehensive basic data framework.

[0109] Step S13107: Add a traceability identifier to the basic data framework. The traceability identifier includes the traceability task number, traceability start time, traceability end time, and traceability execution module information.

[0110] Assign a unique source tracing task number to the basic data framework, such as "TR-20231026-001". The source tracing start time is 09:30:00, the time when the time-series anomaly source tracing analysis is initiated, and the source tracing end time is 09:45:00, the time when all analyses are completed and the basic data framework is generated. The source tracing execution module information records the name and version number of the cloud security analysis platform module used to execute this source tracing analysis. Add the above source tracing identifier to the basic data framework to facilitate the management and tracking of source tracing tasks.

[0111] Step S13108: Retrace the time-series association group sequence to supplement the missing abnormal node files or abnormal transmission metadata features in the basic data framework.

[0112] To ensure the integrity of the basic data framework, the time-series association group sequence is traversed again to check for any missing anomalous nodes or anomalous transmission metadata features not included in the framework. For example, if an intermediate forwarding node's file is found to be missing in the anomalous propagation node sequence, the file for that node is created and added to the anomalous node time-series table. If the transmission metadata features associated with an anomalous node are missing, they are extracted again and added to the anomalous node-transmission metadata feature correspondence table to complete the basic data framework.

[0113] Step S13109: Convert the supplemented and completed basic data framework into a standardized anomaly tracing result document. The format of the anomaly tracing result document includes chapter divisions, which correspond to anomaly node information, anomaly transmission metadata characteristics, and time-series correlation relationships, respectively.

[0114] Following enterprise cloud security management documentation standards, the supplemented and completed basic data framework was converted into an anomaly tracing results document. The document is divided into three main chapters: Chapter 1, Anomaly Node Information, details the archive contents of the anomaly initiation node and anomaly propagation node; Chapter 2, Anomaly Transmission Metadata Characteristics, organizes and displays the characteristic information of each anomaly transmission metadata; Chapter 3, Temporal Relationships, describes the temporal and interaction relationships between anomaly nodes and between anomaly nodes and transmission metadata through a temporal relationship table, making the document structure clear and the content standardized.

[0115] Step S131010: Ensure that the abnormal node identifiers, abnormal transmission metadata characteristics, and timing information in the abnormal source tracing result document are accurately labeled to form the final abnormal source tracing result.

[0116] The anomaly tracing results document is reviewed by cloud-based security analysts to verify whether the anomaly node identifiers match the actual nodes, whether the anomaly transmission metadata characteristics descriptions are accurate, and whether the timing information matches the actual time sequence of the interaction behavior. After confirming that all information is accurate, an approval mark is added to the document, forming the final anomaly tracing results, which serve as the basis for generating subsequent protection rules.

[0117] Step S140: Based on the anomaly tracing results, call the cloud security rule generation library to generate hierarchical targeted protection rules. The hierarchical targeted protection rules include access control rules for the anomaly initiation node, interaction interception rules for the anomaly propagation node sequence, and data filtering rules for the characteristics of anomaly transmitted metadata.

[0118] In an enterprise cloud-based office system scenario, the anomaly tracing results indicated that the anomaly originated from employee terminal A, and the anomaly propagation sequence was employee terminal A → proxy server B → financial server C. The abnormal transmission metadata characteristics included the content identifier of the accessed "salary sheet" and the transmission volume exceeding normal limits. Based on these results, a cloud-based security rule generation library was invoked to generate corresponding protection rules.

[0119] Step S141: Parse the anomaly tracing results, extract the node identifier, service type and permission scope of the anomaly starting node, and determine the access control dimensions for the anomaly starting node. The access control dimensions include service access restrictions, permission scope narrowing, and Internet Protocol address access filtering.

[0120] From the anomaly node information section of the anomaly tracing results document, extract the node identifier UUID, service type (database access service), and permission scope ("R-ALL, W-ALL") of employee terminal A, the starting node of the anomaly. Based on this information, determine the access control dimensions. The service access restriction dimension targets its database access service, considering restricting its access to sensitive databases; the permission scope narrowing dimension aims to adjust the overly broad "R-ALL, W-ALL" permissions to normal permissions consistent with the employee's position; and the Internet Protocol address access filtering dimension filters out abnormal IP address access requests based on the terminal's historical access records.

[0121] Step S142: Call the access control rule template in the cloud security rule generation library, input the node identifier, service type and permission range of the abnormal starting node, and generate the initial access control rule for the abnormal starting node. The initial access control rule includes a list of services that are prohibited from access, a narrowed permission range, and a range of Internet Protocol addresses that are allowed to be accessed.

[0122] Step S1421: Connect to the cloud security rule generation library, read the access control rule template stored in the cloud security rule generation library, parse the template structure, and determine the configurable fields contained in the access control rule template. The configurable fields include node identifier field, service type field, prohibited service field, permission scope field, and allowed Internet protocol address field.

[0123] A connection is established with the cloud-based security rule generation library via the cloud-based security analysis platform's interface. This library stores various security rule templates, and the access control rule template is retrieved and read. The XML structure of the template is parsed to identify configurable fields, including a node identifier field for identifying the originating node of an anomaly, a service type field describing the service type, a prohibited service field listing prohibited services, a permission scope field defining the scope of permissions, and a allowed internet protocol address field limiting the allowed IP range.

[0124] Step S1422: Fill the node identifier of the abnormal starting node into the node identifier field of the template, replacing the placeholder content in the node identifier field.

[0125] The node identifier of employee terminal A, the starting node of the anomaly, is UUID "123e4567-e89b-12d3-a456-426614174000". Fill this UUID string into the node identifier field of the access control rule template, replacing the original "{NODE_ID}" placeholder in the field, so that the template can clearly identify the controlled object.

[0126] Step S1423: Fill in the service type of the abnormal starting node into the service type field of the access control rule template to make the service type description consistent with the format required by the template.

[0127] The service type of the abnormal starting node is "Database Access Service". The template requires that the service type field use a standardized service category name. Query the cloud service category standard dictionary to confirm that the standard expression corresponding to "Database Access Service" is "DatabaseAccessService", and fill it into the service type field, ensuring that the format meets the template requirements.

[0128] Step S1424: Based on the service type of the abnormal starting node, filter out the service names that are directly related to the service type from the cloud service list library, fill the service names into the prohibited service field of the access control rule template, and form a prohibited service list.

[0129] The cloud service list database stores the names and relationships of all the enterprise's cloud services. Based on the service type "DatabaseAccessService", it queries directly related services, such as sensitive database services like "Financial Database Service", "Human Resources Database Service", and "Payroll Database Service". These service names are then entered into the "Prohibited Services" field of the access control rule template to create a list of prohibited services, for example, "Prohibited Services: Financial Database Service, Human Resources Database Service, Payroll Database Service".

[0130] Step S1425: Analyze the permission scope of the abnormal starting node, extract the operation items that need to be shrunk from the permission scope, fill the description of the shrunk permission scope into the permission scope field of the template, and mark the executable and non-executable operations after shrunk.

[0131] The original permission scope of the node that initiated the anomaly was "R-ALL, W-ALL". Analyzing the enterprise's employee position permission standards, the database access permission scope for ordinary employees should be "R-PUB, W-PUB" (read and write public data only). Extract the operations that need to be shrunk, i.e., shrink "R-ALL" to "R-PUB" and "W-ALL" to "W-PUB". Enter the shrunk permission scope description in the permission scope field of the template: "Permission scope: Executable operations - R-PUB (read public data), W-PUB (write public data); Non-executable operations - R-DEP (read department data), R-ALL (read all data), W-DEP (write department data), W-ALL (write all data)".

[0132] Step S1426: Extract the legitimate Internet Protocol address range that matches the service type of the abnormal starting node from the cloud Internet Protocol address management library, while excluding Internet Protocol address ranges with historical illegal access records, and fill the remaining Internet Protocol address ranges into the allowed Internet Protocol address field of the template to form the allowed Internet Protocol address ranges.

[0133] The cloud-based Internet Protocol address (IPA) management database records the legal IP address ranges corresponding to each service type. For the "DatabaseAccessService" type, the legal IP ranges include the enterprise office subnet "192.168.1.0 / 24" and the R&D subnet "192.168.2.0 / 24". A query of historical illegal access records revealed that IPs in the range "192.168.1.100-192.168.1.150" had attempted illegal access; therefore, this subnet was excluded. The remaining legal IP ranges "192.168.1.0-192.168.1.99, 192.168.1.151-192.168.1.255, 192.168.2.0-192.168.2.255" were entered into the allowed IP address field to form the allowed IP address ranges.

[0134] Step S1427: Retrieve the data corresponding to the unfilled fields and fill them in, so that all configurable fields in the access control rule template are filled.

[0135] Check all configurable fields in the access control rule template to ensure that the node identifier field, service type field, prohibited service field, permission scope field, and allowed Internet Protocol address field are correctly filled in and that no fields are missing. If any fields are missing, such as the "effective time field" included in the template, fill in the effective time as "effective immediately" according to the default configuration or security policy settings to ensure that all configurable fields in the template are complete.

[0136] Step S1428: Generate initial access control rule text, wherein the text content includes node identifier, service type, list of services prohibited from access, shrinking permission scope, and allowed Internet Protocol address range.

[0137] Integrate the completed configurable fields to generate the initial access control rule text. The text format follows the preset rule expression method of the template, for example: "Access Control Rule - Node Identifier: 123e4567-e89b-12d3-a456-426614174000; Service Type: DatabaseAccessService; List of services prohibited from access: Financial Database Service, Human Resources Database Service, Payroll Database Service; Shrinking permission scope: Executable operations - R-PUB, W-PUB, Non-executable operations - R-DEP, R-ALL, W-DEP, W-ALL; Allowed Internet Protocol address range: 192.168.1.0-192.168.1.99, 192.168.1.151-192.168.1.255, 192.168.2.0-192.168.2.255." Step S1429: Adjust the prohibited service list or allowed Internet Protocol address range to make the initial access control rules logically rigorous, ensure that the prohibited service list is related to the service type, and include the historically legal Internet Protocol address range, thus forming the final initial access control rules.

[0138] The initial access control rules were reviewed for logical rigor, confirming that services such as the financial database service in the prohibited service list were directly related to the service type DatabaseAccessService, thus meeting the access control objectives. The allowed internet protocol address ranges were checked to ensure they included the IP address "192.168.1.50" used by employee terminal A for historically successful access to the database server, preventing accidental blocking of legitimate access. If services unrelated to the service type, such as "email service," were found in the prohibited service list, they were removed from the list. If the allowed IP range did not contain historically valid IPs, the sub-range containing that IP was added, ultimately forming a logically rigorous initial access control rule.

[0139] Step S143: Extract the sequence of abnormal propagation nodes from the abnormal source tracing results, determine the interaction protocol type, interaction frequency and interaction target node of each abnormal propagation node, and determine the interaction interception dimension for the abnormal propagation node sequence. The interaction interception dimension includes protocol interception, frequency limitation and target node isolation.

[0140] From the anomaly node information and temporal correlation sections of the anomaly tracing results document, the anomaly propagation node sequence was extracted: Employee Terminal A → Proxy Server B → Financial Server C. Analyzing the interaction behavior of each node, the interaction protocol between Employee Terminal A and Proxy Server B was HTTPS, with an interaction frequency of 10 requests per minute during the anomaly period; the target node was Proxy Server B. The interaction protocol between Proxy Server B and Financial Server C was JDBC, with an interaction frequency of 8 times per minute; the target node was Financial Server C. Based on this information, interaction interception dimensions were determined: protocol interception targets abnormal requests in HTTPS and JDBC protocols; frequency limiting restricts excessively high interaction frequencies; and target node isolation prevents the anomaly propagation node from interacting with Financial Server C.

[0141] Step S144: Call the interaction interception rule template in the cloud security rule generation library, input the node identifier, interaction protocol type, interaction frequency and interaction target node of the abnormal propagation node sequence, and generate the initial interaction interception rule for the abnormal propagation node sequence. The initial interaction interception rule includes the protocol type to be intercepted, the interaction frequency threshold, and the list of target nodes to be isolated.

[0142] Connect to the cloud-based security rule generation library, read the interaction interception rule template, and parse out configurable fields such as node identifier sequence field, protocol type field, frequency threshold field, and target node field. Enter the node identifier UUID of the abnormal propagation node sequence into the node identifier sequence field; enter the interaction protocol types HTTPS and JDBC into the protocol type field; set the interaction frequency threshold to 5 times per minute based on historical normal interaction frequency statistics and enter it into the frequency threshold field; enter the IP address of the target node, financial server C, which needs to be isolated, into the target node field. Generate the initial interaction interception rule, specifying the protocol to be intercepted, the frequency to be limited, and the target node to be isolated.

[0143] Step S145: Extract the abnormal transmission metadata features from the abnormal source tracing results, determine the content identifier, transmission volume threshold and transmission direction of the abnormal transmission metadata, and determine the data filtering dimensions for the abnormal transmission metadata features. The data filtering dimensions include content type filtering, transmission volume limit and transmission direction control.

[0144] From the abnormal transmission metadata characteristics section of the abnormal transmission results document, the hash value of the content identified as the query condition "salary table" is extracted, determining the corresponding content type as "sensitive database query result." Based on the historical normal transmission volume range, a transmission volume threshold of 10MB is set; transmissions exceeding this threshold are considered abnormal. The transmission direction is downlink from the financial server C to employee terminal A. Based on this, the data filtering dimensions are determined as follows: content type filtering targets content of the sensitive database query result type; transmission volume limitation restricts transmission data exceeding 10MB; and transmission direction control monitors and manages downlink transmission from the financial server to the employee terminal.

[0145] Step S146: Call the data filtering rule template in the cloud security rule generation library, input the content identifier, transmission volume threshold and transmission direction of the abnormal transmission metadata, and generate an initial data filtering rule for the characteristics of the abnormal transmission metadata. The initial data filtering rule includes the content type to be prohibited from transmission, the upper limit of transmission volume and the prohibited transmission direction.

[0146] The system reads data filtering rule templates from the cloud-based security rule generation library and parses configurable fields such as content identifier, transmission limit, and transmission direction. It then fills the content type ("sensitive database query result") corresponding to the content identifier hash value of the abnormal transmission metadata into the prohibited transmission content type field; fills the transmission limit (10MB) into the corresponding field; and fills the prohibited transmission direction field ("financial server C → employee terminal A") into the prohibited transmission direction field. This generates initial data filtering rules, specifying the content types to be filtered, the transmission limit, and the prohibited transmission directions.

[0147] Step S147: Perform hierarchical adaptation of the initial access control rules, initial interaction interception rules, and initial data filtering rules, so that the execution order of the access control rules is earlier than that of the interaction interception rules, and the execution order of the interaction interception rules is earlier than that of the data filtering rules.

[0148] Step S1471: Establish a rule execution timeline coordinate system with time as the horizontal axis and rule execution priority as the vertical axis.

[0149] In the rule management module of the cloud-based security analytics platform, a two-dimensional rule execution timeline coordinate system is constructed. The horizontal axis represents time, in milliseconds; the vertical axis represents the rule execution priority, with priority values ​​ranging from 1 to 100. The higher the value, the higher the priority and the earlier the execution time.

[0150] Step S1472: Assign an execution priority value to the initial access control rule. The priority value of the access control rule is set to be higher than that of the interaction interception rule and the data filtering rule.

[0151] According to the hierarchical security protection strategy, access control, as the first line of defense, should have the highest priority. Assign a priority value of 80 to the initial access control rule to ensure that it has a higher priority than interaction blocking rules and data filtering rules.

[0152] Step S1473: Assign an execution priority value to the initial interaction interception rule. The priority value of the interaction interception rule is set to be higher than that of the data filtering rule and lower than that of the access control rule.

[0153] Interactive blocking serves as the second line of defense and has a lower priority. The initial interactive blocking rule is assigned a priority value of 50, which is lower than the access control rule's priority of 80 but higher than the data filtering rule's priority.

[0154] Step S1474: Assign execution priority values ​​to the initial data filtering rules. The priority values ​​of the data filtering rules are set to be lower than those of the access control rules and the interaction interception rules.

[0155] Data filtering serves as the last line of defense and has the lowest priority. Assign a priority value of 30 to the initial data filtering rule to ensure that its priority is lower than the 80 priority of access control rules and the 50 priority of interaction blocking rules.

[0156] Step S1475: Mark the priority values ​​of each draft rule on the rule execution timeline coordinate system to form a rule timeline distribution chart.

[0157] The priority values ​​of the initial access control rule (priority 80), the initial interaction interception rule (priority 50), and the initial data filtering rule (priority 30) are marked on the rule execution time sequence coordinate system. The horizontal axis time starts from the time when the rule takes effect, and the vertical axis corresponds to the positions of 80, 50, and 30 respectively, forming an intuitive rule time sequence distribution chart.

[0158] Step S1476: Analyze the execution time interval of each rule in the rule time distribution chart. If the execution time interval of the access control rule and the interaction interception rule is less than the preset interval, increase the priority value of the access control rule and expand the time interval between the two. If the execution time interval of the interaction interception rule and the data filtering rule is less than the preset interval, increase the priority value of the interaction interception rule and expand the time interval between the two.

[0159] The preset rule execution interval is a priority value difference of 20. Checking the rule timing distribution chart, the priority difference between the access control rule (80) and the interaction interception rule (50) is 30, which is greater than the preset interval of 20, so no adjustment is needed; the priority difference between the interaction interception rule (50) and the data filtering rule (30) is 20, which is exactly equal to the preset interval, meeting the requirements. If the priority of the interaction interception rule is 45, and the difference between it and the data filtering rule 30 is 15, which is less than the preset interval, then the priority of the interaction interception rule is adjusted to 55, so that the difference reaches 25, thus expanding the timing interval.

[0160] Step S1477: Determine the execution trigger conditions for each rule. The execution trigger condition for the access control rule is when the abnormal starting node initiates an access request. The execution trigger condition for the interaction interception rule is when the abnormal propagation node initiates an interaction request. The execution trigger condition for the data filtering rule is when a transmission behavior that matches the abnormal transmission metadata characteristics is detected.

[0161] Clearly define the conditions under which each rule is triggered: When employee terminal A, the starting node of the anomaly, initiates any access request, the access control rule is immediately triggered for inspection; when a node in the anomaly propagation sequence, such as proxy server B, initiates an interaction request, the interaction interception rule is triggered; when the system detects transmission behavior that matches the characteristics of abnormal transmission metadata (such as content type being sensitive database query results, transmission volume exceeding 10MB, and transmission direction from the financial server to the employee terminal), the data filtering rule is triggered.

[0162] Step S1478: Adjust the judgment parameters of the execution trigger condition so that the execution trigger time of the access control rule is earlier than that of the interaction interception rule, and the execution trigger time of the interaction interception rule is earlier than that of the data filtering rule.

[0163] The triggering parameter for access control rules is set to be determined when the initial SYN packet of the access request arrives, at which point the connection has not yet been established, making it the earliest triggering time. The triggering parameter for interaction interception rules is set to be determined when the application layer data of the interaction request begins to be transmitted, at which point the connection has been established but data transmission has just begun, making it a later triggering time than access control. The triggering parameter for data filtering rules is set to be determined when the amount of transmitted data reaches 30% of the total transmission volume, at which point data transmission has been in progress for some time, making it the latest triggering time, ensuring that the execution triggering time order conforms to the rule priority.

[0164] Step S1479: Add the adjusted execution priority value and execution triggering condition to the corresponding rule draft to form the hierarchically adapted rule text, and mark the execution sequence and triggering conditions of each rule.

[0165] Add the access control rule priority 80 and trigger condition "when the SYN packet of the abnormal starting node initiates the access request arrives" to the initial access control rule text; add the interaction interception rule priority 50 and trigger condition "when the application layer data of the abnormal propagation node initiates the interaction request begins to be transmitted" to the initial interaction interception rule text; add the data filtering rule priority 30 and trigger condition "when a transmission behavior that matches the abnormal transmission metadata characteristics is detected and the amount of transmitted data reaches 30%" to the initial data filtering rule text, forming a hierarchically adapted rule text, clearly marking the execution sequence and trigger conditions of each rule.

[0166] Step S148: Delete conflicting clauses in the rules after hierarchical adaptation. If the access control rules and the interaction interception rules have different restrictions on the same node, the restrictions of the access control rules shall prevail. If the interaction interception rules and the data filtering rules have different restrictions on the same transmission behavior, the restrictions of the interaction interception rules shall prevail.

[0167] Compare the three rules after hierarchical adaptation and check for any clause conflicts. For example, if the access control rule prohibits employee terminal A from accessing the financial database service, while the interaction blocking rule allows it to access via a specific protocol, then the access control rule's prohibition requirement should prevail, and the conflicting clause in the interaction blocking rule should be deleted. If the interaction blocking rule limits the interaction frequency between proxy server B and financial server C to 5 times per minute, while the data filtering rule allows 8 times per minute, then the 5-times threshold of the interaction blocking rule should be used to adjust the relevant clauses in the data filtering rule to ensure there are no conflicts between the rules.

[0168] Step S149: Add an effective timing tag and an execution scope tag to the adapted rules. The effective timing tag includes the effective start time and duration of each level of protection rule, and the execution scope tag includes the cloud service clusters and network regions to which each level of protection rule applies.

[0169] Add an effective timing tag to the adapted rules, setting the effective start time to "Effective Immediately" and the effective duration to "7 Days" to facilitate timely protection and observation of effects after anomalies are detected. Regarding the scope tag, the access control rules apply to the cloud service cluster "Database Service Cluster" and the network area "Office Area Network"; the interaction interception rules apply to the service cluster "Middleware Service Cluster" and the network area "Internal Core Network"; the data filtering rules apply to the service cluster "Storage Service Cluster" and the network area "Data Center Network," clearly defining the effective time and scope of each rule.

[0170] Step S1410: Classify and organize the tagged rules according to the hierarchy of access control, interaction interception, and data filtering to form a hierarchical targeted protection rule that includes hierarchical identifier, rule content, effective time sequence, and execution scope.

[0171] The tagged rules are categorized and organized according to the hierarchy of access control, interaction interception, and data filtering. A hierarchy identifier is added to each rule category, such as "L1-Access Control," "L2-Interaction Interception," and "L3-Data Filtering." The rule content section includes the specific terms of each rule, the effectiveness sequence section specifies the start time and duration of effectiveness, and the scope of execution clearly defines the applicable service clusters and network areas, ultimately forming a clear, comprehensive, and hierarchical targeted protection rule system.

[0172] Step S150: Convert the hierarchical targeted protection rules into cloud protection execution instructions, send them to the cloud protection execution module, and start the cloud protection execution module to perform cloud data security protection operations according to the hierarchical targeted protection rules.

[0173] The rule conversion module of the cloud-based security analytics platform converts the text format of hierarchical targeted protection rules into JSON format instructions that the cloud-based protection execution module can recognize. For example, the list of prohibited services in access control rules is converted into a "block_services" array in the instructions, and the allowed IP ranges are converted into "allowed_ips" fields. After conversion, the instructions are sent via an encrypted channel to the cloud-based protection execution module deployed at the boundary and internal nodes of the enterprise's cloud-based office system, such as firewalls and intrusion prevention systems. Upon receiving the instructions, the cloud-based protection execution module loads the rules and immediately initiates protection operations, controlling access from abnormal initiation nodes, intercepting interactions from abnormal propagation nodes, and filtering data with abnormal transmission metadata characteristics.

[0174] Step S210: Collect protection operation logs generated during the protection operation performed by the cloud protection execution module. The protection operation logs include records of controlled access requests, records of intercepted interaction requests, records of filtered transmission data, and records of the execution time of each operation.

[0175] The cloud-based protection execution module records all operations in real time during protection actions. The controlled access request log details denied access requests initiated by employee terminal A from the initial node of the anomaly, including the target service and initiation time. The intercepted interaction request log records blocked interaction requests initiated by proxy server B, including protocol type and target node information. The filtered transmission data log records filtered data transmitted from financial server C to employee terminal A, such as data volume and content type. The execution time of each operation is recorded to the millisecond level. All these records together constitute the protection operation log, stored in the protection module's local log file, and periodically uploaded to the cloud-based security log management platform.

[0176] Step S220: Extract the controlled access request records from the protection operation log, analyze the initiating node identifier, target service identifier, control time and control basis rules corresponding to each controlled access request record, and count the number of controlled access requests from different abnormal starting nodes.

[0177] Download the protection operation logs from the cloud security log management platform and use log analysis tools to filter out the controlled access request records. For each record, extract the initiating node identifier (e.g., the UUID of employee terminal A), the target service identifier (e.g., the financial database service ID), the control time (e.g., 09:00-10:00), and the rule ID on which the control is based (e.g., access control rule ID "ACR-001"). Group the records according to the initiating node identifier and count the number of controlled access requests for each abnormal starting node within a unit of time (e.g., per hour). For example, employee terminal A had 15 controlled access requests between 09:00 and 10:00.

[0178] Step S230: Extract the intercepted interaction request records from the protection operation log, analyze the initiating node identifier, target node identifier, interception time, interception protocol type and interception rules corresponding to each intercepted interaction request record, and count the number of intercepted interaction requests for different abnormal propagation nodes.

[0179] Similarly, intercepted interaction request records are extracted from the protection operation logs. Each record is analyzed, including the initiating node identifier (e.g., the UUID of proxy server B), the target node identifier (e.g., the IP of financial server C), the interception time (e.g., 09:15:30), the interception protocol type (e.g., JDBC), and the interception rule ID (e.g., interaction interception rule ID "IIR-001"). Grouped by initiating node identifier, the number of intercepted interaction requests for different abnormal propagation nodes is counted. For example, proxy server B had 8 intercepted interaction requests between 09:00 and 10:00.

[0180] Step S240: Extract the filtered transmission data records from the protection operation log, analyze the initiation identifier, reception identifier, filtering time, filtering content type, filtering data volume and filtering basis rules corresponding to each record, and count the total amount of filtered data with different abnormal transmission metadata characteristics.

[0181] Filter the transmitted data records in the protection operation log, and analyze the initiator identifier (IP of financial server C), receiver identifier (MAC address of employee terminal A), filtering time (e.g., 09:20:15), filtered content type (sensitive database query result), filtered data volume (e.g., 15MB), and filtering rule ID (e.g., data filtering rule ID "DFR-001") of each record. Classify the abnormal transmission metadata characteristics according to their type (e.g., content types corresponding to different content identifiers), and calculate the total amount of data filtered for each characteristic per unit time. For example, the total amount of filtered data for sensitive database query results is 100MB between 09:00 and 10:00.

[0182] Step S250: Based on the statistical data of the number of controlled access requests, the number of blocked interaction requests, and the total amount of filtered data, calculate the execution effectiveness index of each level of protection rules. The execution effectiveness index of access control rules is the ratio of the number of controlled access requests to the total number of access requests. The execution effectiveness index of interaction blocking rules is the ratio of the number of blocked interaction requests to the total number of interaction requests. The execution effectiveness index of data filtering rules is the ratio of the amount of filtered data to the total amount of transmitted data.

[0183] The total number of access requests made by employee terminal A, the initial node of the anomaly, during the protection period is assumed to be 20. Of these, 15 were controlled access requests. Therefore, the effectiveness metric for the access control rule is 15 / 20 = 0.75. The total number of interaction requests made by proxy server B, the node of the anomaly propagation, is 10, with 8 blocked. The effectiveness metric for the interaction blocking rule is 8 / 10 = 0.8. The total amount of data transmitted targeting the metadata characteristics of the anomaly is 120MB, with 100MB filtered. The effectiveness metric for the data filtering rule is 100 / 120 ≈ 0.833. These metrics reflect the actual protection effectiveness of each level of protection rules.

[0184] Step S260: Compare the execution effect indicators of each level of protection rules with the preset effect threshold. If the execution effect indicator of any level of protection rule is lower than the preset effect threshold, analyze the content of the clauses of that level of protection rule to determine whether the poor effect is due to improper parameter settings in the rule clauses.

[0185] The preset performance thresholds are set according to the enterprise security policy. For example, the threshold for access control rules is 0.8, for interaction blocking rules it is 0.75, and for data filtering rules it is 0.8. Comparing the calculated performance metrics with the thresholds, the access control rule metric of 0.75 is lower than the threshold of 0.8, indicating poor performance. Analysis of the terms revealed that the "payroll database service" was not included in the prohibited services list, resulting in uncontrolled access to this service by employee terminal A. This performance issue stemmed from improper parameter settings (an incomplete prohibited services list).

[0186] Step S270: Adjust rule clauses with improper parameter settings, expand the scope of the service list that is prohibited from access in the access control rules, reduce the interaction frequency threshold in the interaction interception rules, and refine the types of content that are prohibited from transmission in the data filtering rules.

[0187] To address the issue of ineffective access control rules, the "Payroll Database Service" has been added to the list of prohibited services, expanding its scope. If the effectiveness of interaction blocking rules is slightly low, the interaction frequency threshold can be lowered from 5 times per minute to 3 times per minute to strengthen the restriction. For data filtering rules, the types of content that are prohibited from transmission have been further refined, including not only "sensitive database query results" but also types that may hide sensitive data, such as "encrypted compressed files." The rule clauses have been optimized by adjusting parameters.

[0188] Step S280: Import the adjusted rule terms into the cloud security rule generation library, update the parameters of the corresponding rule template in the cloud security rule generation library, so that the rules generated subsequently can adapt to the current protection requirements.

[0189] The revised access control rules, interaction blocking rules, and data filtering rules are imported through the management interface of the cloud-based security rule generation library, overriding the original rule template parameters. For example, the "prohibited services" field in the access control rule template is updated to include "payroll database service"; the frequency threshold field in the interaction blocking rule template is updated to 3 times / minute; and the content type field in the data filtering rule template is updated to include "encrypted compressed file," ensuring that subsequent rules generated based on the templates can adapt to changes in current protection requirements.

[0190] Step S290: Based on the updated rule template, regenerate hierarchical targeted protection rules for the corresponding abnormal nodes or abnormal transmission metadata.

[0191] Using the updated rule template, re-enter the relevant information regarding the abnormal initiation node, abnormal propagation node sequence, and abnormal transmission metadata characteristics. Following steps S141 to S1410, generate new hierarchical targeted protection rules. The new rules include an expanded list of prohibited services, reduced frequency thresholds, and refined content types, enabling more effective security protection.

[0192] Step S2100: Convert the regenerated hierarchical targeted protection rules into new cloud protection execution instructions, send them to the cloud protection execution module, start a new round of protection operations, and collect new protection operation logs for effect verification.

[0193] The newly generated hierarchical targeted protection rules are converted into JSON format cloud protection execution instructions and sent to the cloud protection execution module. After loading the new instructions, the module starts a new round of protection operations while continuing to collect protection operation logs. After running for a period of time, the execution effect indicators of each rule are recalculated. If the access control rule indicator improves to 0.85, reaching the preset threshold, the adjusted rule effect is verified to be good; if it still does not meet the standard, steps S260 to S2100 are repeated until all rules meet the requirements.

[0194] In one exemplary embodiment, a network security protection system for cloud data monitoring is provided. This system can be a terminal, server, etc., and its internal structure diagram can be as follows: Figure 2 As shown, the network security protection system for cloud data monitoring includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, near-field communication, or other technologies. When the computer program is executed by the processor, it implements a network security protection method for cloud data monitoring. The display unit of this network security protection system for cloud data monitoring is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of this network security protection system for cloud data monitoring can be a touch layer covering the display screen, or buttons, a trackball, or a touchpad set on the shell of the network security protection system for cloud data monitoring, or an external keyboard, touchpad, or mouse, etc.

[0195] It should be noted that, in order to simplify the description of the present invention and thus help to understand one or more embodiments of the invention, multiple features may sometimes be grouped into one embodiment, drawing or description thereof in the foregoing description of the embodiments of the present invention.

Claims

1. A network security protection method applied to cloud data monitoring, characterized in that, The method comprises: obtaining a cloud interaction behavior chain set and a transmission metadata set generated in a cloud data monitoring process, the cloud interaction behavior chain set comprising a sequence of behavior nodes formed by multiple continuous cloud data interactions and node interaction timing information, and the transmission metadata set comprising an initiation identifier, a receiving identifier, a content identifier and transmission timing information corresponding to each interaction behavior; performing hierarchical dynamic disassembly on the cloud interaction behavior chain set, combining the transmission timing information of the transmission metadata set, and generating a behavior node and transmission metadata association group, the behavior node and transmission metadata association group comprising disassembled behavior nodes and associated transmission metadata; performing timing abnormality tracing on the behavior node and transmission metadata association group, identifying abnormal behavior nodes and associated abnormal transmission metadata, and generating an abnormality tracing result, the abnormality tracing result comprising an abnormal starting node, an abnormal propagation node sequence, an abnormal transmission metadata feature and a timing association relationship; based on the abnormality tracing result, calling a cloud security rule generation library to generate hierarchical targeted protection rules, the hierarchical targeted protection rules comprising access control rules for the abnormal starting node, interaction interception rules for the abnormal propagation node sequence, and data filtering rules for the abnormal transmission metadata feature; converting the hierarchical targeted protection rules into cloud protection execution instructions and sending them to a cloud protection execution module to start the cloud protection execution module to perform cloud data security protection operations according to the hierarchical targeted protection rules.

2. The network security protection method for cloud data monitoring according to claim 1, wherein, The hierarchical dynamic disassembly of the cloud interaction behavior chain set, combining the transmission timing information of the transmission metadata set, and generating a behavior node and transmission metadata association group comprises: dividing each interaction behavior chain in the cloud interaction behavior chain set into an initiation layer, a forwarding layer and a receiving layer according to an interaction level, the initiation layer comprising an interaction initiation node, the forwarding layer comprising an interaction forwarding node, and the receiving layer comprising an interaction receiving node; performing attribute extraction on the behavior nodes of each level to obtain initiation layer node attributes, forwarding layer node attributes and receiving layer node attributes, the initiation layer node attributes comprising an initiation node identifier, an initiation service type and an initiation permission range, the forwarding layer node attributes comprising a forwarding node identifier, forwarding path information and forwarding resource occupation, and the receiving layer node attributes comprising a receiving node identifier, a receiving service type and a receiving data processing capability; extracting transmission timing information of each transmission metadata in the transmission metadata set to establish a timing correspondence relationship between the transmission timing information and the interaction behavior chain, so that each transmission metadata can be matched to a corresponding timing interaction behavior chain; matching the behavior nodes and the transmission metadata according to the interaction level, matching the initiation layer behavior nodes and the transmission metadata comprising the initiation identifier, matching the forwarding layer behavior nodes and the transmission metadata comprising the forwarding path information, and matching the receiving layer behavior nodes and the transmission metadata comprising the receiving identifier; performing packet processing on the matched behavior nodes and transmission metadata to form initial association groups, each initial association group comprising a single level behavior node and associated transmission metadata; According to the node interaction time sequence information of the interaction behavior chain, the time sequence order of the initial association group is adjusted, so that the arrangement order of the initial association group is consistent with the occurrence order of the interaction behavior; After the initial association group is adjusted in time sequence, the attribute is supplemented. If any initial association group lacks behavior node attribute, the attribute information of the corresponding hierarchical behavior node is extracted and added. If the transmission metadata feature is lacking, the transmission metadata in the corresponding transmission metadata set is matched and added; The supplemented initial association group is grouped according to the segmentation identifier of the interaction behavior chain. Each group contains the initial layer, the forwarding layer and the receiving layer association group after the segmentation of the same segment of the interaction behavior chain; A time sequence label is added to each group of association groups. The time sequence label includes the start time, the duration and the end time of the interaction behavior; The association group with the time sequence label is determined as the final behavior node and transmission metadata association group, so that each behavior node and transmission metadata association group contains complete behavior node attribute, transmission metadata and time sequence label.

3. The network security protection method for cloud data monitoring according to claim 1, wherein, The behavior node and transmission metadata association group are subjected to time sequence anomaly tracing, abnormal behavior nodes and associated abnormal transmission metadata are identified, and an abnormal tracing result is generated, including: Extract the time sequence label of all behavior node and transmission metadata association groups, sort the association groups according to the start time in the time sequence label, and form a time sequence association group sequence; For each association group in the time sequence association group sequence, the attribute features of the behavior node and the features of the transmission metadata are extracted. The attribute features include node identifier, service type and permission range. The transmission metadata features include initiation identifier, receiving identifier, content identifier and transmission volume information; A time sequence anomaly judgment benchmark is established. The time sequence anomaly judgment benchmark is based on the statistical characteristics of the association groups without anomaly in history, and includes the normal range of behavior node attribute and the normal range of transmission metadata feature; Compare the behavior node attribute features of the current association group with the normal range of behavior node attribute. If the current behavior node attribute features exceed the normal range of behavior node attribute, the behavior node is marked as a suspected abnormal node; Compare the transmission metadata features of the current association group with the normal range of transmission metadata feature. If the current transmission metadata features exceed the normal range of transmission metadata feature, the transmission metadata is marked as a suspected abnormal transmission metadata; The marked suspected abnormal nodes and suspected abnormal transmission metadata are subjected to time sequence correlation analysis to determine whether the suspected abnormal nodes and suspected abnormal transmission metadata belong to the same time sequence association group. If they belong to the same group, they are determined as abnormal association groups; Starting from the abnormal association group, the subsequent association groups that have node interaction relationship with the abnormal association group are searched along the time sequence association group sequence, and the behavior nodes and transmission metadata in the subsequent association groups are extracted; Compare the attribute similarity of the behavior nodes in the subsequent association groups with the suspected abnormal nodes in the abnormal association group, and compare the feature similarity of the transmission metadata in the subsequent association groups with the suspected abnormal transmission metadata in the abnormal association group. If the attribute similarity and the feature similarity both meet the preset similarity standard, the behavior node in a subsequent association group is determined as an abnormal propagation node, and the transmission metadata is determined as abnormal propagation transmission metadata; The suspected abnormal node in the abnormal association group is determined as an abnormal starting node, the abnormal propagation nodes are arranged in time sequence to form an abnormal propagation node sequence, and the abnormal starting node, the abnormal propagation node sequence, abnormal transmission metadata features, and time sequence association relationship are integrated to generate an abnormal traceability result.

4. The network security protection method for cloud data monitoring according to claim 1, wherein, Based on the abnormal traceability result, a hierarchical targeted protection rule is generated by calling a cloud security rule generation library, including: The abnormal traceability result is analyzed, the node identifier, service type, and permission range of the abnormal starting node are extracted, the access control dimension for the abnormal starting node is determined, and the access control dimension includes service access restriction, permission range contraction, and Internet protocol address access filtering; An access control rule template in the cloud security rule generation library is called, the node identifier, service type, and permission range of the abnormal starting node are input, and an initial access control rule for the abnormal starting node is generated, and the initial access control rule includes a list of prohibited access services, a contracted permission range, and an Internet protocol address interval allowed to access; The abnormal propagation node sequence in the abnormal traceability result is extracted, the interaction protocol type, interaction frequency, and interaction target node of each abnormal propagation node are determined, the interaction interception dimension for the abnormal propagation node sequence is determined, and the interaction interception dimension includes protocol interception, frequency limitation, and target node isolation; An interaction interception rule template in the cloud security rule generation library is called, the node identifier, interaction protocol type, interaction frequency, and interaction target node of the abnormal propagation node sequence are input, and an initial interaction interception rule for the abnormal propagation node sequence is generated, and the initial interaction interception rule includes a protocol type to be intercepted, an interaction frequency threshold, and a list of target nodes to be isolated; The abnormal transmission metadata features in the abnormal traceability result are extracted, the content identifier, transmission volume threshold, and transmission direction of the abnormal transmission metadata are determined, the data filtering dimension for the abnormal transmission metadata features is determined, and the data filtering dimension includes content type filtering, transmission volume limitation, and transmission direction control; A data filtering rule template in the cloud security rule generation library is called, the content identifier, transmission volume threshold, and transmission direction of the abnormal transmission metadata are input, and an initial data filtering rule for the abnormal transmission metadata features is generated, and the initial data filtering rule includes a prohibited content type, a transmission volume upper limit, and a prohibited transmission direction; The initial access control rule, the initial interaction interception rule, and the initial data filtering rule are hierarchically adapted, so that the execution time sequence of the access control rule is earlier than that of the interaction interception rule, and the execution time sequence of the interaction interception rule is earlier than that of the data filtering rule; Conflicting clauses in the rules after hierarchical adaptation are deleted, if the access control rule and the interaction interception rule have different restrictions on the same node, the restriction requirement of the access control rule is used as the standard, and if the interaction interception rule and the data filtering rule have different restrictions on the same transmission behavior, the restriction requirement of the interaction interception rule is used as the standard. The adapted rules are added with effective time label and execution range label, the effective time label includes effective start time and effective duration of each level protection rule, and the execution range label includes cloud service cluster and network area to which each level protection rule is applicable; The rules with labels are classified according to access control, interaction interception and data filtering, to form hierarchical targeted protection rules including level identification, rule content, effective time and execution range.

5. The network security protection method for cloud data monitoring according to claim 2, wherein, The attribute extraction is performed on each level behavior node to obtain initiation layer node attribute, forwarding layer node attribute and receiving layer node attribute, including: The node attribute extraction module is called to connect the cloud node management database to obtain registration information of the initiation layer behavior node in the cloud node management database; The unique identification of the initiation layer behavior node is extracted from the registration information as the initiation node identification, the cloud service category to which the initiation node belongs is extracted as the initiation service type, and the operation range authorized for the initiation node is extracted as the initiation permission range; The initiation permission range is subjected to format standardization processing to convert the permission range description into a uniform permission code sequence, so that the permission range expressions of different initiation nodes are consistent; The path record information of the forwarding layer behavior node in the cloud node management database is obtained, the unique identification of the forwarding layer behavior node is extracted as the forwarding node identification, the node sequence passed through by the forwarding node in the interaction process is extracted as the forwarding path information, and the computing resource and storage resource data occupied by the forwarding node in the interaction are extracted as the forwarding resource occupation; The forwarding path information is subjected to sequence arrangement, the node sequence is arranged according to the forwarding order, the path position identification is added to each node to mark the sequence of the node in the forwarding path; The capability configuration information of the receiving layer behavior node in the cloud node management database is obtained, the unique identification of the receiving layer behavior node is extracted as the receiving node identification, the cloud service category to which the receiving node belongs is extracted as the receiving service type, and the maximum rate of data processing and data storage capacity of the receiving node are extracted as the receiving data processing capability; The attribute information of the corresponding node is re-extracted from the cloud node management database to replace the attribute data inconsistent with the original record; The final initiation layer node attribute, forwarding layer node attribute and receiving layer node attribute consistent with the original record are stored according to the level classification to form a level and node attribute correspondence table.

6. The network security protection method for cloud data monitoring according to claim 3, wherein, The attribute similarity of the behavior node in the subsequent association group and the suspected abnormal node in the abnormal association group is compared, and the feature similarity of the transmission metadata in the subsequent association group and the suspected abnormal transmission metadata in the abnormal association group is compared, including: The attributes of the behavior node in the subsequent association group are divided into identification attribute, service attribute and permission attribute, the identification attribute includes node identification, the service attribute includes service type, and the permission attribute includes permission range; The attributes of the suspected abnormal node in the abnormal association group are also divided into identification attribute, service attribute and permission attribute; Calculate the identity attribute similarity between the subsequent correlation group behavior node and the suspected abnormal node, if the two node identities are the same, the identity attribute similarity is determined as the first level according to the preset standard; if the node identities are different but belong to the same service cluster, the identity attribute similarity is determined as the second level according to the preset standard; if the node identities are different and do not belong to the same service cluster, the identity attribute similarity is determined as the third level according to the preset standard; Calculate the service attribute similarity between the subsequent correlation group behavior node and the suspected abnormal node, if the service types of the two are completely consistent, the service attribute similarity is determined as the first level according to the preset standard; if the service types exist partially overlap, the service attribute similarity is determined as the second level according to the preset standard; if the service types are completely different, the service attribute similarity is determined as the third level according to the preset standard; Calculate the permission attribute similarity between the subsequent correlation group behavior node and the suspected abnormal node, if the permission ranges of the two completely overlap, the permission attribute similarity is determined as the first level according to the preset standard; if the permission ranges exist partially intersection, the permission attribute similarity is determined as the second level according to the preset standard; if the permission ranges have no intersection, the permission attribute similarity is determined as the third level according to the preset standard; Integrate the identity attribute similarity, the service attribute similarity and the permission attribute similarity to determine the overall attribute similarity between the subsequent correlation group behavior node and the suspected abnormal node, and the overall attribute similarity level is the lowest level of the three; Divide the features of the transmission metadata in the subsequent correlation group into identity features, content features and transmission volume features, the identity features include initiation identity and reception identity, the content features include content identity, and the transmission volume features include transmission volume information; Divide the features of the suspected abnormal transmission metadata in the abnormal correlation group into identity features, content features and transmission volume features; Calculate the identity feature similarity between the transmission metadata in the subsequent correlation group and the suspected abnormal transmission metadata, if the initiation identity and the reception identity are both the same, the identity feature similarity is determined as the first level according to the preset standard; if only one identity is the same, the identity feature similarity is determined as the second level according to the preset standard; if the two identities are different, the identity feature similarity is determined as the third level according to the preset standard; Calculate the content feature similarity between the transmission metadata in the subsequent correlation group and the suspected abnormal transmission metadata, if the content identities are the same, the content feature similarity is determined as the first level according to the preset standard; if the content identities belong to the same category, the content feature similarity is determined as the second level according to the preset standard; if the content identities belong to different categories, the content feature similarity is determined as the third level according to the preset standard; Calculate the transmission volume feature similarity between the transmission metadata in the subsequent correlation group and the suspected abnormal transmission metadata, if the transmission volume information is in the same numerical interval, the transmission volume feature similarity is determined as the first level according to the preset standard; if the transmission volume information is in adjacent numerical intervals, the transmission volume feature similarity is determined as the second level according to the preset standard; if the transmission volume information is in non-adjacent numerical intervals, the transmission volume feature similarity is determined as the third level according to the preset standard; The overall feature similarity of the subsequent association group transmission metadata and the suspected abnormal transmission metadata is determined by comprehensively identifying the feature similarity, the content feature similarity and the transmission volume feature similarity, and the overall feature similarity level is the lowest level among the three.

7. The network security protection method for cloud data monitoring according to claim 4, wherein, The initial access control rules, the initial interaction interception rules and the initial data filtering rules are hierarchically adapted, so that the execution time sequence of the access control rules is earlier than that of the interaction interception rules, and the execution time sequence of the interaction interception rules is earlier than that of the data filtering rules, and the method comprises the following steps: A rule execution time sequence coordinate system is established, taking time as the horizontal axis and rule execution priority as the vertical axis; An execution priority value is assigned to the initial access control rules, and the priority value of the access control rules is set to be higher than that of the interaction interception rules and the data filtering rules; An execution priority value is assigned to the initial interaction interception rules, and the priority value of the interaction interception rules is set to be higher than that of the data filtering rules and lower than that of the access control rules; An execution priority value is assigned to the initial data filtering rules, and the priority value of the data filtering rules is set to be lower than that of the access control rules and the interaction interception rules; The priority values of the initial drafts of the rules are marked in the rule execution time sequence coordinate system to form a rule time sequence distribution chart; The execution time sequence interval of each rule in the rule time sequence distribution chart is analyzed, if the execution time sequence interval of the access control rules and the interaction interception rules is less than a preset interval, the priority value of the access control rules is increased to expand the time sequence interval, if the execution time sequence interval of the interaction interception rules and the data filtering rules is less than a preset interval, the priority value of the interaction interception rules is increased to expand the time sequence interval; The execution trigger conditions of the rules are determined, the execution trigger condition of the access control rules is that the abnormal starting node initiates an access request, the execution trigger condition of the interaction interception rules is that the abnormal propagation node initiates an interaction request, and the execution trigger condition of the data filtering rules is that a transmission behavior meeting the abnormal transmission metadata feature is detected; The determination parameters of the execution trigger conditions are adjusted, so that the execution trigger time of the access control rules is earlier than that of the interaction interception rules, and the execution trigger time of the interaction interception rules is earlier than that of the data filtering rules; The adjusted execution priority values and execution trigger conditions are added to the corresponding rule drafts to form the rule texts after hierarchical adaptation, and the execution time sequence and trigger conditions of each rule are marked.

8. The cyber security protection method for cloud data monitoring of claim 1, wherein, After the cloud protection execution module performs the cloud data security protection operation according to the hierarchical targeted protection rules, the method further comprises: Protection operation logs generated in the process of the cloud protection execution module performing the protection operation are collected, the protection operation logs include controlled access request records, intercepted interaction request records, filtered transmission data records and execution time records of each operation; Controlled access request records in the protection operation logs are extracted, the corresponding initiation node identifier, target service identifier, control time and control basis rule of each controlled access request record are analyzed, and the number of controlled access requests of different abnormal starting nodes is counted; Extract the intercepted interaction request record in the protection operation log, analyze the corresponding initiation node identifier, target node identifier, interception time, interception protocol type and interception rule of each intercepted interaction request record, and count the number of intercepted interaction requests of different abnormal propagation nodes; Extract the filtered transmission data record in the protection operation log, analyze the corresponding initiation identifier, receiving identifier, filtering time, filtering content type, filtering data volume and filtering rule of each record, and count the total amount of filtered data of different abnormal transmission metadata characteristics; Based on the counted managed access request number, intercepted interaction request number and filtered data total amount, calculate the execution effect index of each level protection rule, the execution effect index of access control rule is the ratio of managed number to total access request number, the execution effect index of interaction interception rule is the ratio of intercepted number to total interaction request number, and the execution effect index of data filtering rule is the ratio of filtered data volume to total transmission data volume; Compare the execution effect index of each level protection rule with the preset effect threshold value, if the execution effect index of any one level protection rule is lower than the preset effect threshold value, analyze the clause content of the level protection rule, and judge whether the effect is poor due to improper parameter setting in the rule clause; Adjust the rule clause with improper parameter setting, expand the service list range prohibited to access in the access control rule, reduce the interaction frequency threshold in the interaction interception rule, and refine the content type prohibited to transmit in the data filtering rule; Import the adjusted rule clause into the cloud security rule generation library, update the parameters of the corresponding rule template in the cloud security rule generation library, and make the subsequently generated rules adapt to the current protection demand; Based on the updated rule template, regenerate the hierarchical targeted protection rule for the corresponding abnormal node or abnormal transmission metadata; Convert the regenerated hierarchical targeted protection rule into new cloud protection execution instructions, send them to the cloud protection execution module, start a new round of protection operation, and collect new protection operation logs for effect verification.

9. The network security protection method for cloud data monitoring according to claim 4, wherein, The calling access control rule template in the cloud security rule generation library, inputting the node identifier, service type and permission range of the abnormal starting node, generates an initial access control rule for the abnormal starting node, including: Connecting the cloud security rule generation library, reading the access control rule template stored in the cloud security rule generation library, parsing the template structure, determining the configurable fields contained in the access control rule template, and the configurable fields including node identifier field, service type field, prohibited service field, permission range field, and allowed internet protocol address field; Fill in the node identifier of the abnormal starting node into the node identifier field of the template, replace the placeholder content in the node identifier field; Fill in the service type of the abnormal starting node into the service type field of the access control rule template, so that the service type expression is consistent with the format required by the template; Based on the service type of the abnormal starting node, a service name directly associated with the service type is filtered from a cloud service list library, the service name is filled into a prohibited service field of the access control rule template, and a prohibited access service list is formed; The permission range of the abnormal starting node is analyzed, the operation items that need to be contracted in the permission range are extracted, the contracted permission range description is filled into the template permission range field, and the executable operation and the non-executable operation after contraction are marked; The legal Internet protocol address interval matching the service type of the abnormal starting node is extracted from the cloud Internet protocol address management library, while excluding the Internet protocol address interval with historical illegal access records, the remaining Internet protocol address interval is filled into the template allowed Internet protocol address field, and an allowed access Internet protocol address interval is formed; The data corresponding to the unfilled fields is reacquired and supplemented, and each configurable field in the access control rule template is filled; An initial access control rule text is generated, and the text content includes node identification, service type, prohibited access service list, contracted permission range, and allowed access Internet protocol address interval; The prohibited service list or the allowed Internet protocol address interval is adjusted, the initial access control rule text is logically rigorous, the prohibited access service list is associated with the service type, the allowed access Internet protocol address interval contains historical legal access Internet protocol addresses, and the final initial access control rule is formed.

10. A network security protection system applied to cloud data monitoring, characterized in that, It includes: a processor; a machine readable storage medium for storing machine executable instructions of the processor; wherein the processor is configured to execute the machine executable instructions to perform the network security protection method applied to cloud data monitoring in any one of claims 1 to 9.

Images