Cloud data security anomaly detection method and system based on deep learning

Abstract

The invention relates to the technical field of cloud computing data security, and discloses a cloud data security anomaly detection method and system based on deep learning. The method comprises the following steps: acquiring a multi-source data stream from a cloud platform in real time, extracting a multi-dimensional feature vector after quality evaluation and cleaning, and analyzing a topological structure and a node scale of a data environment according to the multi-dimensional feature vector; defining a security monitoring benchmark system based on an analysis result, distributing function roles for the data nodes, and establishing a data security monitoring deployment scheme in combination with a multi-dimensional feature vector; key data entities and monitoring point locations in the scheme are identified, an entity behavior association prediction model is constructed according to the key data entities and the monitoring point locations, and a data state adjustment strategy is made; integrating a deployment scheme and an adjustment strategy, tracking a data flow operation state in real time, and configuring a threat assessment mode in combination with environmental parameter changes; identifying an abnormal behavior event through the mode, and generating an abnormal response measure according to the event and the prediction model; and finally, comprehensively executing intelligent anomaly detection, and outputting a safety state report.

Description

Technical Field

[0001] This invention relates to the field of cloud computing data security technology, specifically to a cloud data security anomaly detection method and system based on deep learning. Background Technology

[0002] Cloud computing technology has experienced rapid development and has been widely applied and promoted globally. With the popularization of the internet and the acceleration of enterprise digital transformation, more and more enterprises and organizations are relying on cloud computing to meet their diverse business needs. In terms of market size, the cloud computing market continues to grow rapidly. According to authoritative statistics, the global cloud computing market has steadily increased at a double-digit growth rate annually over the past few years.

[0003] As the core infrastructure of cloud computing, cloud data centers host massive amounts of data and various application services. Many enterprises are migrating their data to the cloud to gain more efficient data storage, processing, and management capabilities, as well as more flexible resource allocation and cost control advantages. For example, China Unicom's Ningxia Zhongwei Cloud Data Center has an occupancy rate exceeding 85%, providing integrated computing and network services to a wide range of government and enterprise customers. Its "Minning Cloud" project has become a model of digital economy cooperation between eastern and western regions. The Gui'an New Area Huawei Cloud Data Center, capable of accommodating 1 million servers, is Huawei's largest cloud data center globally and a crucial node for Huawei Cloud's business, strongly supporting Guizhou's participation in the "Eastern Data, Western Computing" project. The construction and operation of these large-scale cloud data centers fully demonstrate the key position and important role of cloud computing in today's digital age.

[0004] With the widespread adoption of cloud computing, cloud data security issues are becoming increasingly prominent. In the cloud environment, data faces threats from various anomalies. Once these anomalies occur, they can severely impact the security, integrity, and availability of the data, leading to a series of serious consequences.

[0005] Hardware failures are a common anomaly, such as hard drive damage, memory failure, and server motherboard failure. These hardware problems can lead to data loss, data corruption, or service interruptions. Software vulnerabilities are also a significant issue; vulnerabilities in the operating system, applications, or cloud platform itself can be exploited by attackers, leading to security incidents such as data breaches, data tampering, or malicious attacks. Cyberattacks are also a major threat to cloud data; malware infections can spread in cloud data centers, disrupting the normal operation of data and systems. Furthermore, resource contention can also cause data anomalies. Competition for cloud resources by multiple users or applications can lead to decreased system performance, affecting data processing and transmission efficiency.

[0006] The consequences of these anomalies are extremely serious. Degraded system performance can lead to slow business responses, impacting user experience and reducing a company's competitiveness. Service interruptions can prevent normal business operations, causing direct economic losses, customer churn, and damage to the company's reputation. Data loss or corruption can cause irreparable damage, especially for critical business data and sensitive customer information. For example, in the financial sector, a data breach in a bank's cloud data center could result in the theft of sensitive data such as customer account information and transaction records, causing not only financial losses for customers but also legal action and substantial compensation claims for the bank, severely damaging its brand image and reputation. In the medical field, if hospital cloud-based medical records are tampered with or lost, it could affect doctors' accurate diagnosis and treatment plans, endangering patients' lives and health. In the industrial sector, anomalies in cloud-based production data for manufacturing companies could lead to production disruptions, decreased product quality, increased production costs, delayed delivery times, and impact on market share and economic benefits.

[0007] To address cloud data security issues, traditional anomaly detection methods primarily include rule-based and statistical methods. Rule-based methods involve manually defining a series of rules and matching real-time monitored data against these rules. If the data matches a preset anomaly rule, it is considered an anomaly. For example, setting a certain threshold for the number of failed login attempts as abnormal login behavior; when an account's login failure count reaches or exceeds this threshold, the system issues an anomaly alert. However, this method has significant limitations. With the increasing complexity of cloud environments and the diversification of business scenarios, a large number of rules need to be manually defined to cover various possible anomalies. This is not only extremely labor-intensive but also difficult to comprehensively cover all anomaly scenarios. When new attack methods or abnormal behavior patterns emerge, rule-based detection methods often fail to identify them promptly because the new anomalies may not conform to existing rules, leading to detection lag, increased false positive rates, and poor adaptability.

[0008] Statistical detection methods analyze historical data to establish normal statistical models, such as mean, variance, and probability distribution. During real-time detection, current data is compared to the statistical model; if the data deviates significantly from the normal statistical range, it is considered an anomaly. For example, by analyzing the statistical characteristics of network traffic over a period, a normal traffic model is established; when real-time network traffic exceeds the normal statistical range, an anomaly is considered. However, this method relies on the assumption that the data distribution remains relatively stable over a certain period. In real-world cloud environments, data distribution is often affected by various factors, such as seasonal fluctuations in business operations, the launch of new services, and changes in user behavior. When data distribution changes, statistical model-based detection methods may generate numerous false positives or false negatives, failing to accurately detect true anomalies. Furthermore, for complex data, such as multidimensional time series data, statistical methods perform poorly in processing and analysis, struggling to accurately capture abnormal patterns and potential security threats. Summary of the Invention

[0009] The purpose of this invention is to provide a cloud-based data security anomaly detection method and system based on deep learning, so as to solve the problems mentioned in the background art.

[0010] To achieve the above objectives, this invention provides a cloud-based data security anomaly detection method based on deep learning, the method comprising:

[0011] The system acquires multi-source data streams in real time from the cloud platform, performs quality assessment and cleaning on the data streams, extracts multi-dimensional feature vectors from the data streams, and analyzes the topology and node scale of the data environment based on the multi-dimensional feature vectors.

[0012] Based on the topology and node scale of the data environment, a benchmark system for security monitoring is defined, the functional roles of data nodes in the benchmark system are assigned, and a deployment scheme for data security monitoring is established by combining multi-dimensional feature vectors and functional roles.

[0013] Identify key data entities and their monitoring points in the deployment plan, build a correlation prediction model for entity behavior based on the monitoring points, and formulate data status adjustment strategies using the correlation prediction model and monitoring points.

[0014] Integrate data security monitoring deployment schemes and data status adjustment strategies, track the operational status of data streams in real time, analyze environmental parameter changes based on multi-dimensional feature vectors, and configure threat assessment modes in combination with operational status and environmental parameter changes;

[0015] By using threat assessment models, abnormal behavior events in the data stream are identified. Based on the abnormal behavior events and correlation prediction models, abnormal response measures are generated. Combining threat assessment models, abnormal response measures, and data status adjustment strategies, intelligent anomaly detection of cloud data is performed, and a security status report is output.

[0016] Preferably, the step of acquiring multi-source data streams from the cloud platform in real time, performing quality assessment and cleaning on the data streams, and extracting multi-dimensional feature vectors from the data streams includes: accessing the data interface of the cloud platform to collect real-time data streams and batch data streams; performing integrity verification and noise filtering on the data streams to obtain cleaned data streams; extracting time-series features, statistical distribution features, and contextual features from the cleaned data streams; and combining the time-series features, statistical distribution features, and contextual features into a multi-dimensional feature vector.

[0017] Preferably, the definition of the benchmark system for security monitoring based on the topology and node scale of the data environment includes: analyzing the topology of the data environment to determine the transmission path of the data flow and the node connection relationship; dividing the weight ratio of core nodes and edge nodes according to the node scale; setting the threshold parameters and rule base for security monitoring based on the weight ratio; and defining the benchmark system for security monitoring by combining the transmission path and rule base.

[0018] Preferably, the step of constructing an association prediction model for entity behavior based on monitoring points includes: calculating the interaction frequency and dependence degree between key data entities and surrounding entities based on monitoring points; collecting historical interaction data and training a deep learning network model; predicting the evolution trend and scope of influence of entity behavior through the deep learning network model; and constructing an association prediction model for entity behavior based on the evolution trend and scope of influence.

[0019] Preferably, the step of using the correlation prediction model and monitoring points to formulate a data status adjustment strategy includes: real-time monitoring of the status of data entities in the data stream and identifying data entities with abnormal status; using the correlation prediction model to analyze the impact of data entities with abnormal status on the overall data stream; retrieving log information of data entities with abnormal status to determine the cause of the abnormality; designing a status correction mechanism for data entities based on the degree of impact and the cause of the abnormality; and formulating a data status adjustment strategy by combining monitoring points and the status correction mechanism.

[0020] Preferably, the analysis of environmental parameter changes based on multidimensional feature vectors includes: performing dimensionality reduction processing on the multidimensional feature vectors to obtain a core feature set; extracting environmental parameter indicators from the core feature set, including traffic intensity, access pattern, and error rate; collecting historical records of environmental parameter indicators and calculating the changing trends and periodic patterns; and analyzing the changes in environmental parameters based on the changing trends and periodic patterns.

[0021] Preferably, configuring the threat assessment mode by combining the operating status and changes in environmental parameters includes: monitoring the operating status of the data stream, identifying status fluctuations and abnormal patterns; comparing changes in environmental parameters with the operating status to find correlation characteristics; classifying threat levels and types based on correlation characteristics; setting dynamic assessment algorithms and response thresholds according to threat levels and types; and configuring the threat assessment mode by combining the dynamic assessment algorithm and response thresholds.

[0022] Preferably, the step of identifying abnormal behavior events in the data stream through the threat assessment mode includes: loading the threat assessment mode and scanning the behavior sequence of the data stream in real time; comparing the behavior sequence with the normal pattern library and calculating the deviation score; setting a threshold value for the deviation score and triggering an alarm for abnormal behavior events; recording the timestamp and attribute information of the abnormal behavior events and classifying the events.

[0023] Preferably, the step of generating anomaly response measures based on the abnormal behavior event and the correlation prediction model includes: analyzing the type and severity of the abnormal behavior event and locating the affected data nodes; calling the correlation prediction model to simulate the spread path of the abnormal event; designing an isolation plan and a repair process based on the spread path; and generating anomaly response measures according to the isolation plan and the repair process.

[0024] The intelligent anomaly detection of cloud data and output of security status report include: activating threat assessment mode for real-time monitoring; triggering anomaly response measures when anomaly events are detected; applying data status adjustment strategies to restore the normal state of data flow; recording the detection process and results; and generating a security status report, including anomaly statistics and processing summary.

[0025] Preferably, the present invention also includes a cloud-based data security anomaly detection system based on deep learning, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor, when executing the computer program, implements the steps of the above-described cloud-based data security anomaly detection method based on deep learning.

[0026] Compared with the prior art, the beneficial effects of the present invention are:

[0027] This invention acquires multi-source data streams in real time from a cloud platform, encompassing various data sources from different business systems, data formats, and data sources, ensuring the breadth and comprehensiveness of data sources. Quality assessment and cleaning of these data streams removes noise, duplicate data, and erroneous data, improving data accuracy and usability. By extracting multi-dimensional feature vectors from the data streams, the data can be described and analyzed from multiple dimensions, comprehensively capturing its characteristic information. Analyzing the topology and node scale of the data environment based on the multi-dimensional feature vectors provides a deep understanding of the data flow path and distribution within the cloud platform, offering a comprehensive and accurate data foundation for subsequent security detection. This comprehensive and efficient data processing method enables the system to better cope with the complex and ever-changing cloud data environment, providing strong support for the accurate detection of data anomalies.

[0028] Based on the topology and node scale of the data environment, this invention defines a benchmark system for security monitoring. This benchmark system fully considers the actual situation of the data environment and can accurately reflect the normal operation status and security requirements of the data. The functional roles of data nodes within the benchmark system are assigned, clarifying the responsibilities and functions of each data node in data processing and security monitoring, making monitoring more targeted. By combining multi-dimensional feature vectors and functional roles, a deployment scheme for data security monitoring is established. This scheme can rationally configure monitoring resources and methods according to different data nodes and data characteristics, achieving precise monitoring of data security. This precisely customized security monitoring approach can effectively improve the accuracy and efficiency of monitoring and promptly detect potential security threats.

[0029] Identifying key data entities and their monitoring points in the deployment plan allows for focused attention on data entities and locations with significant impact on data security, improving the focus and effectiveness of monitoring. Based on the monitoring points, a correlation prediction model for entity behavior is constructed. This model can learn and analyze the normal behavior patterns of data entities and predict their future behavioral trends. Using the correlation prediction model and monitoring points, data status adjustment strategies are developed. When potential anomalies are predicted, corresponding adjustments can be taken promptly, such as adjusting data transmission rates and optimizing data storage methods, to maintain normal data operation. This timely anomaly prediction and strategy adjustment mechanism effectively reduces the occurrence of anomalies and mitigates their impact on data security.

[0030] By integrating data security monitoring deployment schemes and data status adjustment strategies, and tracking the operational status of data streams in real time, a comprehensive understanding of the real-time dynamics of data can be achieved. Based on multi-dimensional feature vector analysis of environmental parameter changes, various changing factors in the data environment, such as changes in network bandwidth and server load, can be promptly identified. By configuring threat assessment modes in conjunction with operational status and environmental parameter changes, appropriate threat assessment methods and indicators can be flexibly selected according to different situations, achieving intelligent threat assessment. Through threat assessment modes, abnormal behavioral events in data streams can be accurately identified, and potential security threats can be promptly discovered. This intelligent and flexible threat assessment approach enhances the ability to respond to complex and ever-changing security threats, ensuring the security of cloud data.

[0031] Based on abnormal behavior events and correlation prediction models, anomaly response measures are generated. These measures provide specific response methods and operational steps for different types of abnormal behavior, such as isolating abnormal data, initiating backup data, and notifying security administrators. Combining threat assessment models, anomaly response measures, and data status adjustment strategies, intelligent anomaly detection of cloud data is performed, enabling comprehensive detection and effective response to anomalies. Security status reports are output, providing users with timely feedback on data security status and anomalies, offering decision-making support. This intelligent and proactive anomaly response approach can quickly respond to anomalies, minimizing damage to data security and ensuring the secure and reliable operation of cloud data. Attached Figure Description

[0032] Figure 1 This is a schematic diagram illustrating the working principle of the cloud-based data security anomaly detection method based on deep learning described in this invention.

[0033] Figure 2 A flowchart for acquiring and processing data streams from a cloud platform to extract multidimensional feature vectors;

[0034] Figure 3 This is a flowchart for constructing an entity behavior association prediction model based on monitoring points. Detailed Implementation

[0035] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0036] Please see Figure 1This invention provides a cloud-based data security anomaly detection method and system based on deep learning. The method includes: acquiring multi-source data streams from a cloud platform in real time, performing quality assessment and cleaning on the data streams, extracting multi-dimensional feature vectors from the data streams, and analyzing the topology and node scale of the data environment based on the multi-dimensional feature vectors; defining a benchmark system for security monitoring based on the topology and node scale of the data environment, assigning functional roles to data nodes in the benchmark system, and establishing a data security monitoring deployment scheme by combining the multi-dimensional feature vectors and functional roles; identifying key data entities and their monitoring points in the deployment scheme, constructing a correlation prediction model for entity behavior based on the monitoring points, and formulating a data status adjustment strategy using the correlation prediction model and monitoring points; integrating the data security monitoring deployment scheme and data status adjustment strategy, tracking the running status of the data streams in real time, analyzing changes in environmental parameters based on multi-dimensional feature vectors, and configuring a threat assessment mode based on the running status and changes in environmental parameters; identifying abnormal behavior events in the data streams through the threat assessment mode, generating anomaly response measures based on the abnormal behavior events and the correlation prediction model; and performing intelligent anomaly detection of cloud data by combining the threat assessment mode, anomaly response measures, and data status adjustment strategy, and outputting a security status report.

[0037] Example 1: See Figure 2The process begins with accessing a cloud platform's data interface, which includes an API gateway and message queue components. Real-time data streams are captured using stream processing engines such as Apache Kafka, while batch data streams are loaded from cloud storage systems like object storage. The data streams undergo integrity verification and noise filtering. Integrity verification uses checksum algorithms to verify the integrity of data packets, while noise filtering applies digital filters to remove high-frequency interference components, resulting in a cleaned data stream. From this cleaned data stream, time-series features, statistical distribution features, and contextual features are extracted. Time-series features include the sliding window mean and variance calculations for data points; statistical distribution features involve frequency distribution and outlier analysis; and contextual features encompass metadata and behavioral tagging information from the data source. These features are combined into a multi-dimensional feature vector. The dimensions of this multi-dimensional feature vector are dynamically adjusted according to the data stream type, and normalization ensures consistent scaling. In some embodiments, the data interface implementation supports multiple protocols such as HTTP and MQTT to adapt to different cloud environments. Integrity verification can be enhanced by combining hash functions such as SHA-256. The noise filtering process uses adaptive filters to adjust parameters according to the data stream characteristics. The feature extraction stage uses sliding window technology to update time series features in real time. The calculation of statistical distribution features incorporates probability distribution models such as Gaussian distribution. Context features are parsed using natural language processing techniques to analyze log content. The combination of multi-dimensional feature vectors uses vector concatenation methods. Normalization processing uses min-max scaling or Z-score standardization. Optionally, the cloud platform's data interface can deploy a load balancer to handle high-concurrency access. Real-time data stream capture introduces a backpressure mechanism to prevent data loss. Batch data stream loading uses distributed computing frameworks such as Spark to accelerate processing. Integrity verification can add a retransmission mechanism to cope with network jitter. Noise filtering can integrate wavelet transform to improve denoising effects. The feature extraction process can embed feature selection algorithms to reduce redundancy. The generation of multi-dimensional feature vectors supports dynamic dimensional expansion to adapt to complex scenarios.

[0038] The topology of the data environment is analyzed to determine the transmission paths and node connections of data flows. The topology is modeled as a directed graph using graph theory algorithms. Nodes represent data entities such as servers or databases, and edges represent data transmission channels such as network links. Weights are assigned to core and edge nodes based on node size. Core nodes are assigned higher weights based on data traffic and connection count, while edge node weights are calculated based on their geographical distribution and functional importance. Threshold parameters and a rule base for security monitoring are set based on these weights. Threshold parameters include traffic limits and response time thresholds. The rule base contains predefined security policies such as access control rules. A benchmark system for security monitoring is defined by combining the transmission paths and the rule base. This benchmark system adopts a hierarchical structure, setting monitoring points level by level from the network layer to the application layer. In some embodiments, topology analysis uses a graph database to store node relationships. The determination of transmission paths uses the shortest path algorithm. The identification of node connections supports dynamic updates to reflect network changes. The calculation of the weight ratios of core and edge nodes incorporates machine learning clustering methods for grouping. Threshold parameters can be automatically adjusted based on historical data statistical analysis. The rule base is constructed using logic programming languages ​​such as Prolog to define complex rules. The hierarchical structure of the benchmark system achieves a modular design for easy maintenance. It is understandable that topology modeling can be extended to multi-cloud environments to handle cross-platform data flows, transmission path analysis can incorporate latency and bandwidth constraints to optimize path selection, node size partitioning can introduce an elastic weight mechanism to cope with dynamic additions and deletions of nodes, and the updates of threshold parameters and rule bases can be pushed in real time to ensure the timeliness of policies. The definition of the benchmark system can be integrated with international security standards such as ISO27001 to improve compatibility.

[0039] In practical implementation, multidimensional feature vectors are further used to analyze dynamic changes in the data environment. For example, when the node scale expands, the weight ratios are recalculated and the baseline system is updated to achieve adaptive monitoring. The deployment scheme for data security monitoring is based on functional role allocation. Core nodes deploy real-time detection modules, and edge nodes integrate lightweight agents. Monitoring tasks are coordinated through message middleware. The deployment scheme considers load balancing and fault tolerance mechanisms to avoid single points of failure. The entire implementation process relies on cloud computing resources and utilizes containerization technologies such as Docker to achieve rapid deployment and scaling of modules. Optionally, the analysis of multidimensional feature vectors can be combined with time-series prediction models such as ARIMA to warn of environmental changes. Functional role allocation can introduce roles based on access control models to refine permissions. Real-time detection modules can deploy anomaly detection algorithms such as isolated forests. Lightweight agents can be designed as microservice architectures to reduce resource consumption. Load balancing mechanisms can apply round-robin or consistent hashing algorithms to distribute the load. Fault tolerance mechanisms can integrate redundant backups and automatic recovery processes. It is understandable that the dynamic changes in the data environment can be analyzed to automatically optimize security policies, the optimization of deployment schemes can incorporate performance monitoring metrics such as throughput and latency, and the utilization of cloud computing resources can be combined with serverless computing models to allocate resources on demand.

[0040] In practical implementation, the data interface implementation details during the data acquisition phase include authentication and authorization mechanisms, configuring the sliding window size for real-time data stream capture to adapt to different data rates, and setting batch processing size and parallelism for loading batch data streams to improve efficiency. During integrity verification, low-pass or band-stop filters are used for noise filtering, and filter parameters are adjusted online according to the statistical characteristics of the data stream. In the feature extraction phase, the calculation of time series features incorporates lagged variables and seasonal decomposition, the analysis of statistical distribution features uses kernel density estimation or histogram methods, the extraction of contextual features integrates entity recognition and relation extraction techniques, and the combination of multi-dimensional feature vectors employs feature fusion algorithms such as early fusion or late fusion. In some embodiments, data interface authentication can incorporate multi-factor authentication to enhance security; the sliding window for real-time data stream capture can be dynamically resized based on data volatility; the parallelism setting for batch data stream loading can be automatically optimized based on cluster resources; integrity verification can introduce digital signature technology to enhance tamper resistance; noise filtering can combine deep learning denoising autoencoders to handle complex noise; time series feature extraction can incorporate Fourier transform to capture frequency domain information; statistical distribution feature analysis can apply non-parametric methods to avoid distribution assumptions; contextual feature extraction can use graph embedding technology to encode relational information; and multi-dimensional feature vector combination can employ attention mechanisms to weight important features. Optionally, the data acquisition process can record audit logs for traceability, and feature extraction can cache intermediate results to reduce computational overhead.

[0041] In practical implementation, the specific steps of topology analysis include node discovery and link mapping. Node discovery obtains a node list using network scanning tools; link mapping uses tracing routing technology to determine connectivity; weighting ratio allocation introduces the analytic hierarchy process (AHP) to determine the relative importance of core and edge nodes; threshold parameter setting derives normal ranges from normal data flows based on baseline learning algorithms; and rule base construction uses a rule engine to perform logical reasoning. In some embodiments, node discovery can support automatic discovery protocols such as LLDP to enhance accuracy; link mapping can be incorporated into network topology discovery tools; weighting ratio allocation can apply fuzzy logic to handle uncertainty; threshold parameter setting can introduce adaptive threshold algorithms to adjust according to traffic patterns; rule base construction can integrate automated strategies for machine learning rule generation; and the baseline system definition can include a risk assessment framework to quantify security levels. Optionally, topology analysis can be performed periodically to maintain its current state, and weight ratios can be dynamically updated based on real-time monitoring data.

[0042] Example 2: See Figure 3 Monitoring points collect interaction logs between key data entities and surrounding entities through software probes or hardware sensors deployed on data nodes. These logs include timestamps, entity identifiers, and operation types. The interaction frequency between key data entities and surrounding entities is calculated using a request counting method within a sliding time window, such as counting requests within a five-minute window. Dependency calculation applies graph theory algorithms, such as node centrality metrics or influence diffusion models, to assess the strength of relationships between entities. Historical interaction data is collected, covering records from normal operation periods and periods of abnormal events. Data preprocessing includes deduplication, time alignment, and missing value imputation. A supervised learning framework is used to train a deep learning network model, employing either recurrent neural networks or graph neural network architectures. The input data is a serialized interaction sequence, and the output is a behavior prediction value. The training process optimizes the loss function, such as cross-entropy loss, using a backpropagation algorithm. The deep learning network model predicts the evolution trend and impact range of entity behavior. Evolution trend analysis involves time series prediction, such as using long short-term memory networks to capture long-term dependencies. Impact range assessment calculates potentially affected nodes by simulating abnormal propagation paths. Based on the evolution trend and scope of impact, a correlation prediction model for entity behavior is constructed. The correlation prediction model integrates graph structure information and time series features, and outputs a risk score or behavior anomaly index for each entity. The model is deployed using a microservice architecture and provides real-time prediction services through an application programming interface.

[0043] In some embodiments, the deployment of monitoring points can be extended to multi-cloud environments, supporting cross-platform data entity monitoring. Interaction frequency calculation incorporates a weighted counting method, assigning different weights based on operational importance. Dependency calculation combines semantic analysis techniques to interpret the contextual meaning of interaction content. Historical interaction data collection can be integrated with streaming processing platforms for real-time data ingestion and caching. Deep learning network model training employs distributed computing frameworks, such as TensorFlow or PyTorch, for parallel training to handle large-scale datasets. Predicting the evolution trend of entity behavior can incorporate external variables such as network load or user behavior patterns to enhance prediction accuracy. Impact range assessment can introduce Monte Carlo simulation methods to quantify uncertainty. When constructing a correlation prediction model for entity behavior, multimodal data, such as log data, performance metrics, and network traffic, can be integrated to improve model robustness. Optionally, the implementation of monitoring points can include security encryption mechanisms to protect the confidentiality of interaction logs. Interaction frequency calculation can dynamically adjust the time window size to adapt to different business scenarios. Dependency calculation can apply machine learning classifiers to automatically identify key dependencies.

[0044] In practical implementation, the specific steps for calculating interaction frequency and dependency include data collection, feature extraction, and relationship modeling. The data collection phase involves real-time capture of interaction events via an agent program. The feature extraction phase extracts numerical features such as counts and ratios from raw logs. The relationship modeling phase constructs an entity relationship graph, where nodes represent entities and edge weights represent interaction strength. When collecting historical interaction data, data sources include database transaction logs, application logs, and network traffic records. Data cleaning removes noise and outliers, and data labeling identifies normal and abnormal interaction patterns. The deep learning network model is trained using a mini-batch gradient descent algorithm, iteratively updating model parameters and applying techniques such as dropout or regularization to prevent overfitting. Predicting the evolution trend of entity behavior uses a sequence-to-sequence model, encoding historical sequences and decoding future trends. The scope of influence is calculated using graph traversal algorithms such as breadth-first search to identify connected components. The final entity behavior association prediction model is stored in a serialized format for easy loading and inference, and model version management ensures consistent updates.

[0045] In some embodiments, interaction frequency calculation can introduce a decay factor to give higher weight to recent interactions, and dependency calculation can be combined with community detection algorithms to identify close relationships within entity clusters. Historical interaction data collection can be optimized by setting data retention strategies to balance storage costs and historical depth. Training deep learning network models can utilize transfer learning techniques to accelerate convergence using pre-trained models. Predicting evolution trends can integrate attention mechanisms to focus on key time points, and impact scope assessment can be incorporated into risk propagation models, such as epidemic models simulating abnormal spread. When building association prediction models, interpretable reports, such as feature importance scores, can be output to aid decision analysis. Optionally, the processes for calculating interaction frequency and dependency can be automated and executed periodically to maintain up-to-date state. Training deep learning network models can monitor performance metrics such as accuracy and recall, triggering retraining when performance degrades.

[0046] Understandably, the deployment of monitoring points needs to consider network topology changes, dynamically adjust probe positions, and ensure that interaction frequency and dependency calculations support real-time updates to reflect the dynamics of entity behavior. The collection scope of historical interaction data can be extended to long-term history to capture seasonal patterns. Data partitioning for training deep learning network models employs stratified sampling to ensure balance across categories. The results of predicting the evolution trend and impact range of entity behavior can be used in early warning systems to trigger intervention measures in advance. The output format of the correlation prediction model should be standardized for easy integration with other security modules. Understandably, the entire implementation process relies on highly available computing infrastructure to ensure the continuity and low latency of model services.

[0047] In practical implementation, the selection and configuration details of the deep learning network model include the number of network layers, activation functions, and optimizer settings. Training data is divided into training, validation, and test sets. The validation set is used for hyperparameter tuning, and the test set is used for final evaluation. The interaction frequency calculation can be implemented using a stream processing engine to calculate counts within a window in real time. Dependency calculation integrates a graph computation library and executes a node centrality algorithm. When collecting historical interaction data, a time-series database is used to optimize time-range query efficiency. The training process is accelerated using GPUs to shorten training time. The model output for predicting evolution trends is a multi-dimensional time series, and the impact range evaluation results are represented in a graph structure. The construction of the association prediction model includes model serialization and deployment script writing. Optionally, different variants of the deep learning network model architecture can be experimented with, such as gated recurrent units or temporal convolutional networks, to select the best-performing model. Interaction frequency calculation can incorporate an overlapping sliding window mechanism for smooth transitions, and dependency calculation can introduce dynamic weight adjustments to adapt to changes in entity importance.

[0048] In practical implementation, the real-time application of the entity behavior correlation prediction model involves the deployment of a model inference service. This inference service is encapsulated using containerization technologies such as Docker, with a load balancer distributing requests. Interaction data from monitoring points flows into the inference pipeline in real time, where a preprocessing module converts it into the model input format. The correlation prediction model calculates behavior scores, compares the scores with thresholds, and triggers alerts or response actions. The model update mechanism supports online learning, periodically fine-tuning model parameters with new data. Performance monitoring tracks inference latency and accuracy metrics to ensure service stability. In some embodiments, the inference service deployment can adopt a serverless architecture, scaling resources on demand. The preprocessing module can be integrated with a feature engineering pipeline to automatically process raw data. Model updates can be configured with A / B testing to verify the effectiveness of the new model before full deployment. Optionally, a result caching layer can be added for real-time applications to reduce redundant calculations, and performance monitoring can be configured with alert rules to automatically correct abnormal metrics.

[0049] It is understandable that building and implementing a correlation prediction model for entity behavior is an iterative process. From data collection to model deployment, multiple iterations of optimization are required. The coverage of monitoring points should be as comprehensive as possible to reduce blind spots. The results of interaction frequency and dependency calculations should be visualized to assist manual analysis. The quality of training data for deep learning network models is crucial and requires continuous cleaning and labeling. The accuracy of predicting evolution trends and the scope of impact directly affects the anomaly detection effect. The integration method of the correlation prediction model should be flexible and support plug-in expansion.

[0050] Example 3: By monitoring the status of data entities in the data stream in real time, performance metrics are continuously collected using monitoring agents deployed on data nodes. These metrics include CPU utilization, memory usage, network I / O throughput, and disk read / write latency. Data entities with abnormal status are identified using a dynamic threshold-based comparison method or a machine learning classifier. The dynamic threshold is automatically calculated and periodically adjusted based on historical baseline data. The machine learning classifier can use the isolated forest algorithm or a single-class support vector machine model to detect outliers in the metric vectors. An association prediction model is used to analyze the impact of abnormal data entities on the overall data stream. This analysis involves inputting the status information of the abnormal entities into a pre-trained association prediction model. The model outputs a list of affected entities and an impact strength score. The quantification of the impact involves simulating changes in data stream topology connectivity and data transmission efficiency loss under scenarios of abnormal entity failure or performance degradation. Log information of abnormal data entities is retrieved from system log files, application logs, and database transaction logs. The cause of the anomaly is determined by using a rule engine to parse error codes and warning messages in the logs, and sequence pattern matching technology is used to identify the abnormal event chain.

[0051] Based on the degree of impact and the cause of the anomaly, a state correction mechanism for data entities is designed. This mechanism includes automatically restarting service instances, reallocating computing resources, switching traffic to backup nodes, or performing data consistency verification and repair operations. The mechanism design follows a priority strategy, prioritizing rapid recovery measures for data entities with high impact levels. Combining monitoring points and the state correction mechanism, a data state adjustment strategy is formulated. This strategy is coded in an executable script or workflow definition language and managed and distributed through a strategy engine. The strategy content clearly defines the triggering conditions, execution actions, and rollback schemes. In some embodiments, real-time monitoring of data entity states in the data stream can introduce distributed tracing technology to accurately track the performance status of cross-service call chains. Identifying data entities with abnormal states can be achieved through multi-dimensional indicator fusion analysis, reducing false alarm rates. When using correlation prediction models to analyze the degree of impact, real-time graph computation technology can be introduced to dynamically update the predicted impact range. The process of retrieving log information can be integrated with a log aggregation platform to achieve cross-node log correlation analysis. Determining the cause of the anomaly can be achieved by applying root cause analysis algorithms to locate the root cause of the problem. Designing a state correction mechanism can take resource constraints into account, optimize the cost-effectiveness of correction actions, and formulate data state adjustment strategies to support strategy version management, facilitating strategy retrospection and updates. Optionally, real-time monitoring can be configured with an adaptive sampling frequency to increase monitoring granularity during periods of high load, and multiple threshold levels can be set to distinguish anomalies of different severity levels.

[0052] In practical implementation, dimensionality reduction is performed on the multidimensional feature vectors to obtain the core feature set. Dimensionality reduction employs either principal component analysis (PCA) or an autoencoder neural network. PCA extracts the feature component with the largest variance through linear transformation. The autoencoder neural network maps the high-dimensional input to a low-dimensional latent space through an encoder and then reconstructs it through a decoder. The network is trained with the goal of minimizing reconstruction error, and the encoder output is ultimately used as the core feature set. Environmental parameter indicators are extracted from the core feature set. These indicators include traffic intensity, access patterns, and error rate. Traffic intensity is measured by the number of data packets or requests per unit time. Access patterns analyze the behavioral sequence characteristics of users or the system, such as access frequency, operation type, and session duration. The error rate calculates the proportion of failed transactions or abnormal responses in the total transaction volume. Historical records of these environmental parameter indicators are collected and stored in a time-series database. Time series analysis techniques are applied to calculate trends and periodic patterns. Trend calculation uses moving averages or exponential smoothing to capture long-term directions. Periodic pattern analysis uses Fourier transform to decompose the time series into components of different frequencies to identify seasonal patterns. Based on trends and cyclical patterns, environmental parameter changes are analyzed. The analysis focuses on identifying anomalous changes that deviate from historical normal patterns and correlates these changes with external events or system modifications. In some embodiments, dimensionality reduction can compare the effectiveness of different dimensionality reduction algorithms, such as linear discriminant analysis or t-distributed random neighborhood embedding, and select the optimal method based on data characteristics. Extracting environmental parameter indicators can define composite indicators, such as combining traffic intensity with error rate to generate a health score. Collecting historical records allows for setting data retention strategies to balance storage space with analytical needs. Calculating trends and cyclical patterns can incorporate machine learning models such as Prophet for more accurate predictions. Analyzing environmental parameter changes can construct a change impact map to assess the potential impact of parameter changes on system stability. Optionally, multidimensional feature vectors can be standardized before dimensionality reduction to eliminate the influence of dimensions. Environmental parameter indicator extraction can be performed in real time and fed into the stream processing pipeline for immediate analysis.

[0053] It is understandable that formulating data status adjustment strategies and analyzing changes in environmental parameters are two closely related processes. The effectiveness of data status adjustment strategies depends on the accurate interpretation of changes in environmental parameters, and the analysis results of environmental parameter changes provide a decision-making basis for the triggering timing and intensity adjustment of data status adjustment strategies. Real-time monitoring of data entity status needs to be comprehensive to avoid monitoring blind spots. The accuracy of the correlation prediction model directly affects the reliability of the impact degree analysis, and thus the rationality of the status correction mechanism design. The quality of dimensionality reduction processing determines whether the core feature set retains the most informative parts of the original data. The definition of environmental parameter indicators should have clear business meaning, facilitating understanding and intervention by operations and maintenance personnel. The length and quality of historical records directly affect the accuracy of calculating change trends and periodic patterns, thus influencing the conclusions of environmental parameter change analysis.

[0054] In practical implementation, the design details of the state correction mechanism include mechanism selection logic, execution parameter settings, and side effect evaluation. For example, for anomalies caused by resource exhaustion, the mechanism prioritizes resource reallocation rather than restarting. Execution parameters, such as resource allocation, are dynamically calculated based on the severity of the anomaly. Side effect evaluation considers the potential impact of the correction action on surrounding entities. The data state adjustment strategy formulation process includes strategy drafting, simulation testing, review and approval, and deployment to ensure the rigor and effectiveness of the strategy. Principal component analysis methods for dimensionality reduction involve covariance matrix calculation and eigenvalue decomposition. Training autoencoder neural networks requires a large amount of unlabeled data. Access pattern analysis in environmental parameter indicators may involve user behavior sequence modeling, using Markov chains or recurrent neural networks to characterize state transition probabilities. The basic formula for the exponential smoothing method in trend calculation is:

[0055]

[0056] in: Indicates a point in time The smoothing value, Indicates a point in time The actual observed value, The smoothing coefficient is between 0 and 1. Periodicity analysis identifies significant frequency peaks through the spectrum obtained by Fourier transform.

[0057] In some embodiments, designing a state correction mechanism can establish a mechanism knowledge base, accumulate effective correction measures under different abnormal scenarios, and formulate data state adjustment strategies by designing strategy templates to improve strategy development efficiency. The dimensionality reduction process can monitor the information loss rate of features after dimensionality reduction to ensure the representativeness of the core feature set. Extracting environmental parameter indicators can establish indicator lineage and track the data sources that indicator calculation depends on. Calculating change trends and periodic patterns can adopt incremental calculation methods to reduce the overhead of full data calculation. Optionally, the state correction mechanism can include a manual confirmation step; high-risk operations require administrator approval before execution, and the data state adjustment strategy can set a strategy effective time window to achieve time-segmented strategy application.

[0058] Example 4: Operational status monitoring is achieved through a metric collector deployed at key nodes of the data pipeline. The metric collector collects performance metrics in real time, including throughput, response latency, error code frequency, and concurrent connections. It identifies status fluctuations and abnormal patterns by using a sliding window statistical technique to calculate the mean and standard deviation of the metrics. When a real-time metric value exceeds three standard deviations from the historical baseline, it is marked as a status fluctuation. For abnormal pattern detection, unsupervised learning clustering algorithms such as K-means are used to group the metric vectors and identify abnormal patterns that deviate from the normal cluster. Environmental parameter changes are compared with operational status to identify correlation features. Environmental parameter change data comes from an independent environmental monitoring module and includes information on traffic intensity trends, access pattern evolution, and error rate fluctuations. Comparative analysis uses statistical correlation calculation methods such as Pearson correlation coefficient or nonlinear correlation metrics based on mutual information to calculate the correlation strength between each environmental parameter and operational status metric. Feature pairs with correlation coefficients exceeding a predetermined threshold (e.g., absolute value greater than 0.7) are selected as significantly correlated features.

[0059] Referring to Table 1, threat levels and types are categorized based on relevance characteristics. Threat levels are divided into high, medium, and low levels according to the strength of relevance and the scope of impact. High-level threats correspond to characteristics with high relevance coefficients and impact on core business functions. Threat types are categorized based on abnormal behavior, such as resource exhaustion, unauthorized access, data leakage, and service interruption. Dynamic assessment algorithms and response thresholds are set according to threat levels and types. The dynamic assessment algorithm uses an adaptive weighted assessment model, assigning different weight coefficients to different threat levels. The response thresholds are optimized using machine learning based on a historical threat event database, enabling adaptive adjustment of thresholds according to the environment. Threat assessment modes are configured in conjunction with the dynamic assessment algorithm and response thresholds. Threat assessment modes are stored in configuration files, containing algorithm parameters, threshold logic, and assessment rules, and are dynamically loaded and updated through a policy management interface. The threat assessment mode is loaded, and the behavior sequence of the data stream is scanned in real time. The behavior sequence is reconstructed from network traffic by the packet parsing engine, containing fields such as source address, destination address, operation type, and timestamp. Real-time scanning analyzes each behavior record through the stream processing engine. A deviation score is calculated by comparing the behavior sequence with a normal pattern library. The normal pattern library consists of feature contours trained from historical normal behavior data. The deviation score is calculated using Euclidean distance or cosine similarity to measure the degree of deviation between the current behavior and the normal pattern. A threshold value for the deviation score is set to trigger an abnormal behavior event alarm. The threshold value is determined based on percentile statistics (e.g., the 95th percentile of historical deviation scores). The event response process is activated immediately after the alarm is triggered. The timestamp and attribute information of the abnormal behavior event are recorded, and the event is classified. Event classification uses a multi-class machine learning model (such as random forest or gradient boosting decision tree) to automatically classify the event type based on attribute features.

[0060] Table 1: Correspondence between Threat Level and Type and Assessment Parameters

[0061] In some embodiments, monitoring the operational status of data streams can incorporate a multi-dimensional health scoring model, generating a unified status score by integrating multiple indicators. Identifying status fluctuations and abnormal patterns can be achieved by combining change point detection algorithms to accurately pinpoint the time points of state abrupt changes. Comparing changes in environmental parameters with operational status can introduce time-lag correlation analysis to discover the correlation between parameters leading or lagging behind status changes. Classifying threat levels and types can establish a threat knowledge graph to characterize the causal relationships between different threat types. Setting dynamic evaluation algorithms and response thresholds can employ reinforcement learning mechanisms to optimize algorithm parameters and threshold levels based on feedback results. Configuring threat evaluation modes can support mode templates, facilitating rapid deployment to different cloud environments. Real-time scanning of data stream behavior sequences can utilize deep packet inspection technology to parse application layer protocol content. Comparing behavior sequences with a normal pattern library can introduce dynamic time warping algorithms to handle the matching problem of variable-length behavior sequences. Setting critical values ​​for deviation scores can implement a hierarchical criticality strategy, applying different criticality standards to different behavior categories. Recording and classifying abnormal behavior events can integrate third-party threat intelligence to enrich event classification features. Optionally, the running status monitoring can be configured with a heartbeat detection mechanism to enhance monitoring reliability, and the abnormal pattern recognition can fuse the results of multiple weak classifiers to improve detection stability.

[0062] In practical implementation, the specific implementation of dynamic evaluation algorithms may involve complex logical operations. For example, weighted moving average anomaly detection algorithms assign higher weights to recent data, while mutation point detection algorithms analyze the second-order difference changes in time series. Response threshold adjustment coefficients are used to scale the base threshold to adapt to different sensitivity requirements; the coefficient values ​​are determined through performance evaluations on historical validation sets (such as precision-recall curves). Building a normal pattern library is a continuous learning process, requiring periodic injection of validated normal behavior data to update the pattern baseline. The calculation of deviation scores needs to consider differences in feature weights, assigning higher weight factors to key behavioral features (such as administrator privilege operations). Alarm triggering mechanisms need to avoid flood attacks, typically employing delayed confirmation or counting window strategies to ensure the accuracy and effectiveness of alarms. Training the event classification model requires a large amount of labeled data, derived from the experience and judgment of security experts and historical event records. Optionally, the threat assessment mode configuration interface can provide a visual drag-and-drop function to reduce configuration complexity. Real-time scanning of behavioral sequences can employ hardware acceleration technologies, such as FPGA processing of network card data, reducing the load on the host CPU.

[0063] It is understandable that configuring threat assessment models and identifying anomalous behavior events constitute a closed-loop detection system. The accuracy of the threat assessment model directly determines the efficiency of anomalous behavior event identification, while the accumulation of anomalous behavior events provides data feedback for optimizing the threat assessment model. Comprehensive operational status monitoring is the foundation for detecting status fluctuations, and accurate measurement of environmental parameter changes is a prerequisite for meaningful comparisons. The selection of relevant features needs to balance sensitivity and specificity to avoid overfitting or underreporting. Reasonable classification of threat levels and types helps in the precise scheduling of subsequent response resources. The setting of dynamic assessment algorithms and response thresholds needs to strike a balance between real-time performance and accuracy. The representativeness of the normal pattern library determines the reliability of deviation score calculation, and the accuracy of event classification affects the effectiveness of subsequent handling measures.

[0064] In practical implementation, the comparative analysis of environmental parameter change data and operational status data needs to address time alignment issues. Interpolation methods are typically used to align data sequences with different sampling frequencies to a unified time axis. Threat level classification rules can be automatically generated based on decision tree models, improving classification objectivity. The execution engine of the dynamic assessment algorithm needs high throughput and low latency, often developed using compiled languages ​​and deployed on high-performance servers. An adaptive adjustment mechanism for response thresholds can monitor false positive and false negative rates as feedback signals. Version management of the threat assessment model is crucial; each update requires recording change logs and performing rollback tests. Encrypted traffic may be encountered during real-time scanning of behavioral sequences; in such cases, cryptographic feature analysis or external intelligence can be used for auxiliary judgment. The initial value of the deviation score threshold can be set based on the training data distribution and dynamically fine-tuned during runtime based on performance. The abnormal behavior event record database needs to be security-hardened to prevent event log tampering. Optionally, threat assessment model testing can construct simulated attack datasets for verification, and behavioral sequence analysis can introduce the concept of behavioral baselines to establish personalized normal patterns for different users or services.

[0065] Example 5: In-depth analysis of anomalous behavior events. The analysis of the type and severity of anomalous behavior events is achieved through the collaborative work of a rule engine and a classification model. The rule engine matches a predefined feature rule base of attack patterns, while the classification model uses a support vector machine or multilayer perceptron to calculate event feature vectors and output type labels and severity scores. Locating affected data nodes is accomplished by querying the asset configuration management database and analyzing internet protocol addresses, port numbers, and service identifiers in real-time event logs. An association prediction model is invoked to simulate the propagation path of the anomalous event. The association prediction model receives the anomalous event features and a list of affected nodes as input, calculates the probability of influence propagation between nodes using a graph neural network, and simulates the propagation path using a breadth-first search algorithm to traverse the data flow topology, marking all potentially affected adjacent nodes and dependent services. Based on the propagation path, an isolation scheme and remediation process are designed. The isolation scheme specifies the list of nodes requiring network isolation or access blocking and the sequence of isolation operation instructions. The remediation process includes vulnerability patching steps, data recovery verification procedures, and service restart checkpoints. Anomaly response measures are generated based on the isolation plan and repair process. These measures are encapsulated into structured, executable workflows. The workflow definition language describes the goal, parameters, execution conditions, and rollback strategy for each action.

[0066] The threat assessment mode is activated for real-time monitoring. Running as a resident process on the monitoring server, it continuously analyzes incoming data packets and system logs. When anomaly events are detected, it triggers emergency response measures. The triggering mechanism publishes messages via the event bus to notify the workflow engine to pull and execute the corresponding response workflow. Data state adjustment strategies are applied to restore the normal state of the data flow. These strategies may include adjusting load balancing weights, switching database master-slave nodes, or cleaning up abnormal session connections. The strategy executor applies these adjustments according to a predefined priority order. The detection process and results are recorded, and a security status report is generated. The security status report includes a summary of anomaly event statistics, response execution logs, a current system security posture assessment, and a summary of the handling effect. The report is generated periodically in a structured document format or triggered on demand. In a specific example, suppose the threat assessment mode detects a data leakage-type anomaly event from a specific Internet Protocol address. The event is characterized by abnormally high-frequency access to the user database. The analysis steps determine its type as "data leakage," with a severity rating of "high," and the affected nodes are identified as the user service node and the core database node. A correlation prediction model is invoked to simulate the diffusion path. The prediction results show that the authentication service node may be affected within 3 minutes. Based on this propagation path, the designed isolation scheme immediately cuts off the network connection of the abnormal Internet Protocol address and temporarily isolates outbound access from user service nodes. The remediation process includes forcibly resetting relevant user session tokens, checking database operation logs to confirm the scope of the leak, and patching the security vulnerability that led to unauthorized access. The generated anomaly response workflow is triggered, automatically executing the above isolation and remediation actions. Data state adjustment strategies are applied, such as reducing the load weight of user service nodes to zero to divert traffic, and gradually restoring the weight after remediation. The entire process and results are recorded, and the generated security status report details the time of occurrence of the anomaly, the affected nodes, the response measures taken, the details of the data state adjustments, and the final recovery status.

[0067] In some embodiments, analyzing the type and severity of anomalous behavior events can integrate natural language processing (NLP) technology to analyze event description text for classification assistance; locating affected data nodes can be achieved by combining real-time dependency graph analysis tools to improve accuracy. Simulating the spread path of anomalous events using correlation prediction models can introduce parallel computing frameworks to accelerate the traversal of large-scale topology graphs; designing isolation schemes and remediation processes based on the spread path can establish a scheme template library to support rapid matching and generation. Generating anomaly response measures can add a pre-assessment stage of measure effectiveness, simulating execution in a sandbox environment to predict effects. Initiating a threat assessment mode for real-time monitoring can deploy distributed probes to improve monitoring coverage; triggering anomaly response measures when an anomalous behavior event is detected can be achieved by designing multi-level triggering mechanisms to adapt to events of different severity levels. Applying data status adjustment strategies can set up policy application approval processes for high-risk operations; recording the detection process and results can introduce blockchain technology to ensure the immutability of logs. Optionally, analyzing event types and severity can allow security analysts to perform manual review and label correction; locating affected nodes can be achieved by visually displaying node relationship graphs to aid decision-making.

[0068] In practical implementation, the workflow definition for generating anomaly response measures needs to precisely describe each automated step. For example, an isolation plan for a data leak incident might include specific instructions such as "calling the firewall's application programming interface to add blocking rules" and "notifying the load balancer to remove specific nodes from the service pool." The remediation process might include a sequence of operations such as "executing security patch scripts," "triggering data backup and recovery procedures," and "running consistency verification tools." The workflow engine needs to have an error handling mechanism, automatically retrying or triggering predefined backup plans when a step fails. The generated security status report should not only include text descriptions but also integrate visual charts showing the time distribution of the anomaly, the impact range topology, and the timeline of response measures. The report format should support Extensible Markup Language (Extreme Markup Language) or Portable Document Format (PDF) to adapt to the integration needs of different downstream systems. Optionally, the response workflow can be designed as interruptible, allowing administrators to manually confirm critical steps before continuing. Another option is to set different levels of detail in the security status report, such as a summary version for management and a detailed version for the technical team.

[0069] It is understandable that generating anomaly response measures and executing intelligent anomaly detection constitute a complete closed-loop security response system. The effectiveness of anomaly response measures directly depends on the accuracy of preliminary analysis and prediction, while the final effect of intelligent anomaly detection is reflected in the recovery status of the data stream and the quality of the security status report. Activating threat assessment mode is a continuous protection activity, and its real-time monitoring capability is a prerequisite for timely triggering of response measures. Applying data status adjustment strategies is the core operation of the recovery phase and requires careful design to avoid introducing secondary failures. Recording the detection process and results is not only used for report generation but also serves as an important feedback data source for optimizing the entire anomaly detection system. This embodiment relies on seamless integration and high automation of each link.

[0070] In practical implementation, the association prediction model is typically invoked via remote procedure calls or application programming interfaces (APIs), requiring low latency and high availability to ensure rapid acquisition of prediction results in emergency situations. Simulating the propagation path of anomalies needs to consider the strength of dependencies between nodes and time decay factors to make the simulation results more closely resemble real-world scenarios. The isolation scheme design needs to balance security and business continuity, avoiding excessive isolation that could impact normal services. The remediation process needs to clearly define the responsible parties and timeout handling mechanisms for each step. The workflow engine execution requires detailed logging to support auditing and troubleshooting. The generation frequency and triggering conditions of security status reports can be customized based on business importance; for example, more frequent reports can be generated for core business systems. In a specific example, for a resource abuse anomaly, analysis revealed its type to be "resource abuse," its severity to be "medium," and the affected area to be the compute node cluster. The association prediction model simulation showed that it might spread to storage nodes. The isolation scheme was designed to limit resource usage for the abusive process rather than completely isolating it, and the remediation process included optimizing resource scheduling algorithms. The generated response workflow was triggered, and the data state adjustment strategy subsequently adjusted the resource allocation strategy. The security status report summarizes the abnormal peak in resource utilization during this incident, the control measures taken, and the adjusted resource utilization.

[0071] Optionally, standardized response workflow templates can be pre-configured for different types of anomalies during implementation. When common anomalies occur, these templates can be directly invoked for a rapid response. For complex or novel anomalies, a manual analysis process involving experts can be initiated to customize response measures. The workflow engine supports version management, allowing for smooth upgrades of response measures without affecting ongoing tasks. The distribution of security status reports can be integrated with a message notification system, automatically sending reports to relevant responsible parties. Optionally, a response measure knowledge base can be established to continuously accumulate effective handling solutions for different scenarios, allowing the system to learn and optimize itself.

[0072] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A cloud-based data security anomaly detection method based on deep learning, characterized in that, The method includes: The system acquires multi-source data streams in real time from the cloud platform, performs quality assessment and cleaning on the data streams, extracts multi-dimensional feature vectors from the data streams, and analyzes the topology and node scale of the data environment based on the multi-dimensional feature vectors. Based on the topology and node scale of the data environment, a benchmark system for security monitoring is defined, the functional roles of data nodes in the benchmark system are assigned, and a deployment scheme for data security monitoring is established by combining multi-dimensional feature vectors and functional roles. Identify key data entities and their monitoring points in the deployment plan, build a correlation prediction model for entity behavior based on the monitoring points, and formulate data status adjustment strategies using the correlation prediction model and monitoring points. Integrate data security monitoring deployment schemes and data status adjustment strategies, track the operational status of data streams in real time, analyze environmental parameter changes based on multi-dimensional feature vectors, and configure threat assessment modes in combination with operational status and environmental parameter changes; By using threat assessment models, abnormal behavior events in the data stream are identified. Based on the abnormal behavior events and correlation prediction models, abnormal response measures are generated. Combining threat assessment models, abnormal response measures, and data status adjustment strategies, intelligent anomaly detection of cloud data is performed, and a security status report is output.

2. The cloud data security anomaly detection method based on deep learning as described in claim 1, characterized in that, The process of acquiring multi-source data streams in real time from the cloud platform, performing quality assessment and cleaning on the data streams, and extracting multi-dimensional feature vectors from the data streams includes: accessing the data interface of the cloud platform to collect real-time data streams and batch data streams; performing integrity verification and noise filtering on the data streams to obtain cleaned data streams; extracting time series features, statistical distribution features, and contextual features from the cleaned data streams; and combining the time series features, statistical distribution features, and contextual features into a multi-dimensional feature vector.

3. The cloud data security anomaly detection method based on deep learning as described in claim 1, characterized in that, The aforementioned benchmark system for security monitoring, based on the topology and node scale of the data environment, includes: analyzing the topology of the data environment to determine the transmission path and node connection relationship of the data flow; dividing the weight ratio of core nodes and edge nodes according to the node scale; setting threshold parameters and rule base for security monitoring based on the weight ratio; and defining the benchmark system for security monitoring by combining the transmission path and rule base.

4. The cloud data security anomaly detection method based on deep learning as described in claim 1, characterized in that, The method of constructing an association prediction model for entity behavior based on monitoring points includes: calculating the interaction frequency and dependence degree between key data entities and surrounding entities based on monitoring points; collecting historical interaction data and training a deep learning network model; predicting the evolution trend and scope of influence of entity behavior through the deep learning network model; and constructing an association prediction model for entity behavior based on the evolution trend and scope of influence.

5. The cloud data security anomaly detection method based on deep learning as described in claim 1, characterized in that, The process of developing a data status adjustment strategy using correlation prediction models and monitoring points includes: real-time monitoring of the status of data entities in the data stream and identifying data entities with abnormal status; using correlation prediction models to analyze the impact of abnormal data entities on the overall data stream; retrieving log information of abnormal data entities to determine the cause of the abnormality; designing a status correction mechanism for data entities based on the degree of impact and the cause of the abnormality; and developing a data status adjustment strategy by combining monitoring points and the status correction mechanism.

6. The cloud data security anomaly detection method based on deep learning as described in claim 1, characterized in that, The method for analyzing environmental parameter changes based on multidimensional feature vectors includes: performing dimensionality reduction on the multidimensional feature vectors to obtain a core feature set; extracting environmental parameter indicators from the core feature set, including traffic intensity, access patterns, and error rates; collecting historical records of environmental parameter indicators and calculating their changing trends and periodic patterns; and analyzing environmental parameter changes based on these trends and periodic patterns.

7. The cloud data security anomaly detection method based on deep learning as described in claim 1, characterized in that, The method of configuring a threat assessment mode by combining operational status and changes in environmental parameters includes: monitoring the operational status of the data stream and identifying status fluctuations and abnormal patterns; comparing changes in environmental parameters with the operational status to find correlation characteristics; classifying threat levels and types based on correlation characteristics; setting dynamic assessment algorithms and response thresholds according to threat levels and types; and configuring a threat assessment mode by combining dynamic assessment algorithms and response thresholds.

8. The cloud data security anomaly detection method based on deep learning as described in claim 1, characterized in that, The step of identifying abnormal behavior events in the data stream through a threat assessment model includes: loading the threat assessment model and scanning the behavior sequence of the data stream in real time; comparing the behavior sequence with a normal pattern library and calculating the deviation score; setting a threshold value for the deviation score and triggering an alarm for abnormal behavior events; and recording the timestamp and attribute information of the abnormal behavior events for event classification.

9. The cloud data security anomaly detection method based on deep learning as described in claim 1, characterized in that, The process of generating anomaly response measures based on abnormal behavior events and correlation prediction models includes: analyzing the type and severity of abnormal behavior events and locating affected data nodes; calling the correlation prediction model to simulate the propagation path of abnormal events; designing isolation schemes and repair processes based on the propagation path; and generating anomaly response measures based on the isolation schemes and repair processes. The intelligent anomaly detection of cloud data and output of security status report include: activating threat assessment mode for real-time monitoring; triggering anomaly response measures when anomaly events are detected; applying data status adjustment strategies to restore the normal state of data flow; recording the detection process and results; and generating a security status report, including anomaly statistics and processing summary.

10. A cloud-based data security anomaly detection system based on deep learning, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the deep learning-based cloud data security anomaly detection method according to any one of claims 1 to 9.

Images