Security defense processing system based on server host security

Abstract

The invention discloses a security defense processing system based on server host security, which relates to the technical field of computer system defense and comprises a data acquisition component, a data processing component and a defense processing component. According to the method, the function that a traditional software layer detects bottom-layer invisible malicious program exceptions which are difficult to recognize is complemented, the threat amplification effect of continuous / cross-link cooperative attacks is quantified based on the function, the link weight of an attack chain is dynamically optimized based on defense effect feedback, and the security of the continuous / cross-link cooperative attacks is improved. According to the method, hardware exception, threat values, system vulnerability and attack frequency are converted into hierarchical priorities, then precise scheduling of defense resources is completed, crossing from passive defense to active intelligent defense is completed, and a more precise and more adaptive dynamic defense solution is provided for server host security.

Description

Technical Field

[0001] This invention relates to the field of computer system defense technology, specifically a security defense processing system based on server host security. Background Technology

[0002] With the rapid development of the digital economy, servers, as core infrastructure in key sectors such as finance, government affairs, and energy, face increasingly complex cyberattack threats. On the one hand, traditional attack patterns are evolving towards multi-stage collaboration. Attackers no longer rely on single vulnerabilities for intrusion but instead achieve penetration through continuous or cross-stage attack chains such as "port scanning → abnormal login → file tampering." Such attacks are highly concealed and spread rapidly. On the other hand, attacks on underlying hardware anomalies are gradually becoming a new type of threat. Stealth malware evades detection by upper-layer security software by tampering with CPU instruction cycles and interfering with memory page error rates. Traditional defense systems based on software logs struggle to identify such underlying anomalies. At the same time, server asset values ​​vary greatly, and vulnerability remediation status changes dynamically. Static defense strategies cannot adjust resource allocation priorities according to real-time threat scenarios, resulting in high-value, highly vulnerable servers not receiving timely responses when attacked.

[0003] Against this backdrop, server host security defense systems need to have the ability to collaboratively perceive threats, dynamically quantify attack chains, and iteratively optimize defense strategies. However, existing technologies mostly focus on single-dimensional threat detection and lack integrated analysis of multi-stage collaborative attacks and underlying hardware anomalies, making it difficult to meet the defense needs in complex scenarios. Summary of the Invention

[0004] The purpose of this invention is to provide a security defense system based on server host security, which solves the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a security defense processing system based on server host security, comprising a data acquisition component, a data processing component, and a defense processing component. The data acquisition component acquires relevant data of the server host operation, including anomaly identification data, threat quantification data, and collaborative update data, and inputs the collected data into the data processing component. The data processing component cleans the data, and after cleaning, it is input into the defense processing component.

[0006] The defense processing component:

[0007] Based on the current instruction cycle change, historical baseline instruction cycle change, memory page error rate, historical baseline page error rate and weight coefficient in the anomaly identification data, the hardware behavior fingerprint deviation is output. The underlying anomaly is identified through the hardware behavior fingerprint deviation, providing a basis for threat quantification.

[0008] Based on the threat score of each link in the attack chain, the weight of each link in the attack chain, the asset value coefficient, the attack weapon coefficient, the coordination coefficient, and the deviation of the hardware behavior fingerprint in the threat quantification data, the attack chain time-series threat value is output, and the real-time threat level of the current attack chain is quantified by the attack chain time-series threat value.

[0009] Based on the deviation of hardware behavior fingerprint, the system vulnerability coefficient and attack frequency coefficient in the anomaly identification data, and the attack chain time-series threat value, dynamic defense priority is output, and the urgency of defending against the current attack is quantified by the dynamic defense priority.

[0010] The security defense processing system also includes a threat correction component: iterates the weights of the attack chain links based on the defense effect of the i-th link in the collaborative update data, the average defense effect of all links, and the iteration step size; and iterates and corrects the coordination coefficient based on the path length coefficient, the coordination amplification factor, and the transition probability of link j after the attack link i occurs in the collaborative update data.

[0011] The attack chain temporal threat value is recalculated based on the synergy coefficient and attack chain link weights after iteration until the iteration convergence condition is met. Then, a stable strategy is output based on the dynamic defense priority.

[0012] Optionally, the defense processing component includes an anomaly identification module, a threat quantification module, and a priority determination module.

[0013] Optionally, the processing logic of the anomaly detection module is as follows:

[0014] The absolute deviation of the current instruction cycle change from the historical baseline instruction cycle change is calculated as a percentage of the baseline value to reflect the degree of abnormal fluctuation in CPU computing efficiency. The absolute deviation of the memory page error rate from the historical baseline page error rate is calculated as a percentage of the baseline value to reflect the degree of abnormality in memory access. Weighting coefficients are used to integrate the deviation of the two hardware indicators into a comprehensive value to reflect the difference in the contribution of different hardware indicators to anomaly identification.

[0015] By using two underlying hardware metrics—instruction cycle fluctuation and memory page error rate—the deviation of server hardware operating status from historical benchmarks can be quantified, identifying hidden malicious programs that are difficult to detect with traditional software-layer defenses, and providing underlying anomaly evidence for subsequent threat assessments.

[0016] Optionally, the processing logic of the threat quantification module is as follows:

[0017] The threat scores of the three core attack links are weighted and summed, and then multiplied with the weight of the attack chain link in the kth iteration to obtain the basic threat value of the attack chain. Hardware anomalies are associated with the attack chain threat to form a hardware anomaly amplification factor. The product of the asset value coefficient, attack weapon coefficient, and synergy coefficient is used as the scenario and synergy amplification factor to reflect the amplification effect of the superposition of factors. By dynamically quantifying the real-time threat level of the attack chain, it not only considers the threat of individual attack links, but also integrates the hardware anomaly amplification effect, asset value, attack weapon destructive power, and synergy attack amplification effect, thus solving the problem of "ignoring link correlation" in traditional attack chain threat assessment.

[0018] Optionally, the processing logic of the priority determination module is as follows:

[0019] By integrating attack chain threat values, hardware anomalies, system vulnerabilities, and attack frequency into dynamic defense priorities, the defense system can make decisions based on the urgency level and achieve intelligent resource allocation.

[0020] The hardware behavior fingerprint deviation is increased by 1 to amplify the priority weight of hardware anomalies. This is then multiplied by the logarithmically processed attack chain timing threat value, system vulnerability coefficient, and attack frequency coefficient to form the core priority calculation term as the numerator. The attack frequency coefficient is increased by 0.5 as the denominator to form the frequency correction term. After priority scaling, the result is rounded to the nearest integer to obtain the dynamic defense priority.

[0021] Optionally, the threat correction component includes a coefficient correction module and a weight correction module.

[0022] Optionally, the correction logic of the coefficient correction module is as follows:

[0023] The transition probability is multiplied by the synergy amplification factor and the path length coefficient to form the synergy attack amplification value. The synergy attack amplification value is then increased by 1 to form the synergy coefficient. This quantifies the threat amplification effect of continuous attacks, identifies leapfrog and highly covert APT attacks, and avoids the underestimation of the threat by traditional models due to ignoring the links between stages.

[0024] Optionally, the correction logic of the weight correction module is as follows:

[0025] The average defense effect of all links minus the defense effect of the i-th link is used as the numerator, and the average defense effect of all links plus 0.1 is used as the denominator to form the defense effect deviation rate. This is multiplied by the iteration step size and then 1 is added to form the weight adjustment factor. The weight adjustment factor is multiplied by the attack chain link weight of the k-th iteration to obtain the attack chain link weight of the (k+1)-th iteration. Through the defense effect feedback, the weight of each link in the attack chain is dynamically adjusted, so that the defense resources are automatically tilted towards the "weak link", thereby realizing the self-optimization of the defense strategy.

[0026] Optionally, the iteration triggering logic of the threat correction component is as follows:

[0027] The threat mitigation component is triggered when any of the following conditions are met:

[0028] A: Dynamic defense priority ≥ 6;

[0029] B: Coordination coefficient ≥ 1.5;

[0030] C: Hardware error ≥1.0;

[0031] The iterative convergence logic of the threat correction component is as follows: the iteration ends when any one of the following conditions is met:

[0032] D: The number of iterations reached 5;

[0033] E: The average defense effect remains unchanged after two consecutive iterations.

[0034] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0035] I. This invention calculates the relative deviation between the CPU instruction cycle change and the memory page error rate, and combines a weighting coefficient to prioritize CPU-level anomalies, thereby achieving low-level identification of hidden malicious programs. This provides a quantitative basis for hardware anomalies in subsequent threat assessments and fills the blind spots of traditional software-level detection.

[0036] II. This invention obtains a basic threat value by weighted summation of threat scores and initial weights for each link in the attack chain, and combines hardware anomaly amplification factor, asset value coefficient, attack weapon coefficient, and synergy coefficient to quantify the threat amplification effect of continuous / cross-link synergistic attacks.

[0037] Furthermore, the synergy coefficient identifies jump-type APT attacks through the transition probability matrix, amplification factor, and path length coefficient. Based on the deviation between the defense effect and the average defense effect, the link weight is dynamically adjusted to tilt defense resources towards the weak links.

[0038] Third, this invention transforms threats into fixed-priority levels by multiplying hardware anomaly amplification factor, logarithmic threat value, system vulnerability coefficient, and attack frequency coefficient, combined with frequency correction term and scaling factor, thereby achieving priority resource scheduling in high vulnerability and high-frequency attack scenarios and balancing the sensitivity and stability of threat assessment. Attached Figure Description

[0039] Figure 1 This is a schematic diagram illustrating the working principle of the defense processing component of the present invention;

[0040] Figure 2 This is an iterative flowchart of the present invention. Detailed Implementation

[0041] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0042] For examples, please refer to Figure 1 and Figure 2 This invention provides a security defense system based on server host security, including a data acquisition component, a data processing component, and a defense processing component. The data acquisition component acquires relevant data about the server host's operation, including anomaly identification data, threat quantification data, and collaborative update data. The anomaly identification data includes instruction cycle data collected by the performance monitoring unit built into the server CPU, and the current instruction cycle change ΔIPC compared with the historical baseline instruction cycle change ΔIPC. base The page fault rate (PFR) and historical baseline page fault rate (PFR) are obtained by collecting page fault logs through the operating system kernel's memory management module. base Attack frequency coefficient V, weight coefficient α, and system vulnerability coefficient U;

[0043] Threat quantification data includes the status of each link in the attack chain collected by a server intrusion detection system, and a threat score S for each link in the attack chain, assigned a value of 0 or 1 based on whether the attack was successful. i The attack chain link weights W are set based on the security experts' experience in assessing the threats at each link in the attack chain. i The asset value coefficient C, attack weapon coefficient W, and cooperation coefficient K are preset by the administrator based on the business importance of the server.

[0044] The collected anomaly identification data, threat quantification data, and collaborative update data are input into the data processing unit. After cleaning, the data is then input into the defense processing unit for calculation. The defense processing unit includes an anomaly identification module, which is based on the current instruction cycle change ΔIPC and the historical baseline instruction cycle change ΔIPC in the anomaly identification data. base Page Fault Rate (PFR) and Historical Baseline Page Fault Rate (PFR) base The hardware behavior fingerprint deviation F is output along with the weighting coefficient α. The underlying anomalies are identified through the hardware behavior fingerprint deviation F, providing a basis for threat quantification.

[0045] The processing logic of the anomaly detection module is as follows:

[0046]

[0047] The current instruction cycle change ΔIPC, representing the fluctuation of the server's instruction execution cycle per unit time, reflects the real-time changes in CPU computing efficiency. The historical baseline instruction cycle change ΔIPC... base The Page Fault Rate (PFR) is designed to represent the statistical average of changes in historical instruction cycles under normal server operation. It indicates the frequency of page misses triggered when a program accesses memory within a given unit of time, reflecting the degree of memory access anomalies. This is achieved through historical benchmark PFR data. base The reaction server is a statistical average of the historical page error rate when it is running normally. α is a weighting coefficient with a value of 0.6, which means that the change in the current instruction cycle ΔIPC has a higher priority than the memory page error rate PFR in anomaly identification. Since the CPU is the core computing component of the server, its anomalies are more likely to be associated with underlying malicious programs, so it needs to be given a higher weight. The memory page error rate is used as an auxiliary indicator with a lower weight. Hardware anomalies caused by underlying hidden malicious programs are identified by the hardware behavior fingerprint deviation F, which measures the degree of deviation of the server hardware operation indicators from the historical benchmark.

[0048] Specifically, this is achieved by calculating the current instruction cycle change ΔIPC and the historical baseline instruction cycle change ΔIPC. base The absolute deviation relative to the baseline value reflects the degree of abnormal fluctuation in CPU computing efficiency. This is achieved by calculating the page fault rate (PFR) and the historical baseline page fault rate (PFR). base The absolute deviation of the two hardware indicators is used as a percentage of the baseline value to reflect the degree of abnormality in memory access. The deviation of the two hardware indicators is integrated into a comprehensive value using a weighting coefficient α, which reflects the difference in contribution of different hardware indicators to anomaly identification. By using two underlying hardware indicators, the deviation of the server hardware operating status from the historical baseline is quantified, and hidden malicious programs that are difficult to detect by traditional software layer defenses are identified. This provides underlying anomaly basis for subsequent threat assessment and fills the blind spots of software layer detection.

[0049] The defense processing component also includes a threat quantification module, which scores a threat S based on the attack chain links in the threat quantification data. i The attack chain link weights Wi, asset value coefficient C, attack weapon coefficient W, coordination coefficient K, and hardware behavior fingerprint deviation F are used to output the attack chain time-series threat value T. The real-time threat level of the current attack chain is quantified by the attack chain time-series threat value T. The processing logic of the threat quantification module is as follows:

[0050] The processing logic of the threat quantification module is as follows:

[0051] Where S iThreat scoring for each stage of the attack chain: S1 is port scanning, S2 is abnormal login, and S3 is file tampering. Values ​​range from 0 to 1, where 0 indicates no threat and 1 indicates a successful attack at that stage. W i （k） , where represents the weight of each link in the attack chain in the k-th iteration, indicating the importance weight of each link in the attack chain in the k-th iteration. The initial values ​​are 0.2, 0.3, and 0.5. Since file tampering poses a greater threat to the system, it has the highest weight, followed by abnormal login, and port scanning has the lowest relative threat. k represents the iteration number, and the iteration method is described below. C is the asset value coefficient, reflecting the importance of the server, with core servers taking 2 and ordinary servers taking 1, thus reflecting the value of the attacked target. W is the attack weapon coefficient, reflecting the destructive power of the attack method, with 0-day vulnerabilities taking 3 and regular vulnerabilities taking 1, reflecting the threat amplification effect of continuous / cross-link attacks. K is the synergy coefficient, ranging from 1.0 to 2.5. The higher the value, the stronger the threat of synergistic attacks. T （k） The attack chain time-series threat value for the k-th iteration is used to quantify the real-time threat level of the current attack chain, including continuous / cross-stage coordinated attacks.

[0052] Specifically, the threat scores of the three core attack links are weighted and summed, and then multiplied with the weight of the attack chain link in the k-th iteration to obtain the basic threat value of the attack chain. Hardware anomalies are then correlated with the attack chain threat W. i （k） The correlation is used to form a hardware anomaly amplification factor. The product of the asset value coefficient C, the attack weapon coefficient, and the W synergy coefficient K is used as the scenario and synergy amplification factor to reflect the amplification effect of the superposition of factors. By dynamically quantifying the real-time threat level of the attack chain, it not only considers the threat of a single attack link, but also integrates the hardware anomaly amplification effect, asset value, attack weapon destructive power and synergy attack amplification effect, thus solving the problem of "ignoring the correlation of links" in traditional attack chain threat assessment.

[0053] The security defense processing system also includes a threat correction component, which includes a weight correction module. The collaborative update data includes collecting the defense results of each link in the attack chain using EDR tools and assigning them values ​​of 0 or 1 to obtain the defense effect E of the i-th link. i And through the analysis of 3 E i The average defense effect obtained by taking the arithmetic mean Iteration step size β;

[0054] This also includes a path length coefficient L directly assigned based on the attack chain path type recorded by the SIEM system, a synergy amplification factor γ, and a transition probability M obtained by analyzing attack logs from the past 6 months through the SIEM system, which calculates the proportion of attacks occurring from stage i to stage j out of the total number of attacks. ijFirst, based on the defense effect E of the i-th stage in the collaboratively updated data. i Average defensive effect across all stages The attack chain weights are iterated using an iteration step size β. Specifically, the iteration method is as follows:

[0055]

[0056] Among them, W i （k+1） The weight of the process in the (k+1)th iteration is... With E i To collect defense results at each stage of the attack chain using EDR tools, such as whether file tampering was blocked by the firewall, the EDR tool was used to analyze the attack chain. i Assign a value of 0 or 1, where 0 indicates the attack breaks through the defense, and 1 indicates the attack is terminated. For 3 E i The arithmetic mean of the weights is used, and β is the iteration step size, which is 0.1. This controls the adjustment range of the weights during iteration. The weight adjustment range of each iteration does not exceed 10% to avoid the system being unstable due to excessive adjustment in a single step. Using small step size iterations allows the weights to gradually converge to the optimal value, ensuring the stability of the defense strategy.

[0057] The numerator is the average defense effect of all stages minus the defense effect of the i-th stage, and the denominator is the average defense effect of all stages plus 0.1. This avoids the special case where the denominator is 0 when all stages fail. This constitutes the defense effect deviation rate. The product of this deviation rate and the iteration step size is multiplied by 1 to form the weight adjustment factor. The weight adjustment factor is multiplied by the attack chain stage weights of the k-th iteration to obtain the attack chain stage weights of the (k+1)-th iteration. Through defense effect feedback, the weights of each stage of the attack chain are adjusted, allowing defense resources to automatically tilt towards the weakest stages, thus achieving self-optimization of the defense strategy.

[0058] The threat correction component also includes a coefficient correction module, which is based on the path length coefficient L, the cooperative amplification factor γ, and the transition probability M of stage j after the attack stage i occurs in the collaborative update data. ij The synergy coefficient K is iteratively corrected. More specifically, the synergy coefficient K is calculated as follows:

[0059]

[0060] Where M ijThis represents the attack logs from the past 6 months analyzed through the Security Information and Event Management (SIEM) system. It counts the proportion of attacks occurring from stage i to stage j out of the total number of attacks. The value is directly assigned based on the attack chain path type recorded by the SIEM system. γ is the collaboration amplification factor, set to 0.5, which controls the degree of influence of collaborative attacks on the collaboration coefficient K, avoiding excessively large collaboration coefficient K values ​​that could lead to threat value overflow. L is the path length coefficient, which is 1.0 for 2 consecutive stages, 1.2 for 3 consecutive stages, and 1.5 for 1 stage. Since cross-stage attacks are more covert and more likely to be APT attacks than consecutive stage attacks, the L value is higher.

[0061] The transition probability is multiplied by the synergy amplification factor γ and the path length coefficient L to form the synergy attack amplification value. The synergy attack amplification value is then increased by 1 to form the synergy coefficient K. This quantifies the threat amplification effect of continuous attacks, identifies leapfrog and highly covert APT attacks, and avoids the underestimation of the threat by traditional models due to ignoring the links between stages.

[0062] The attack chain temporal threat value is recalculated based on the synergy coefficient K and the weight of the attack chain links after iteration until the iteration convergence condition is met. Then, a stable strategy is output based on the dynamic defense priority. The specific convergence condition is described later.

[0063] The defense processing component also includes a priority judgment module, which is based on the hardware behavior fingerprint deviation F, the system vulnerability coefficient U and attack frequency coefficient V in the anomaly identification data, and the attack chain time-series threat value T. （k） Output dynamic defense priority P （k） Through dynamic defense priority P （k） Quantify the urgency of defending against the current attack;

[0064] The priority judgment module's processing logic is as follows: it integrates attack chain threat value, hardware anomaly, system vulnerability, and attack frequency into a dynamic defense priority P. （k） This provides the defense system with a basis for determining the level of urgency, enabling intelligent resource allocation;

[0065]

[0066] Where P （k）The dynamic defense priority for the k-th iteration quantifies the urgency of defending against the current attack, with values ​​ranging from 1 to 15. 1-5 represent low priority, 6-10 represent medium priority, and 11-15 represent high priority. When the output is low priority, routine defense actions are performed, such as recording attack logs and updating attack characteristics in the threat intelligence database. When the output is medium priority, enhanced monitoring strategies are activated, increasing the log collection frequency of the attacked links and performing deep scanning of files and ports associated with the attack chain. When the output is high priority, emergency defense actions are immediately performed, including blocking the attack source IP, isolating the attacked server, suspending suspicious processes, and sending real-time alerts to the administrator.

[0067] By analyzing T (k) Logarithmic processing is performed to compress the range of threat values, preventing high threat values ​​from causing priority overflow. At the same time, the differentiation of high-threat scenarios is enhanced to prevent excessively large values ​​from causing priority imbalance. The system vulnerability coefficient U reflects the vulnerability patching status of the server, taking 2 when no patches are applied and 1 when all patches are applied, thus reflecting the security shortcomings of the system itself. The attack frequency coefficient V represents the number of attacks occurring per unit time, taking 2 when there are ≥5 attacks per hour and 1 when there are 1-4 attacks per hour, thus reflecting the intensity of attacks.

[0068] By adding 1 to the hardware behavior fingerprint deviation F, the priority weight of hardware anomalies is amplified, and this is combined with the logarithmically processed attack chain timing threat value T. （k） The system vulnerability coefficient U and the attack frequency coefficient V are multiplied to form the core priority calculation term as the numerator. The vulnerability of the system itself and the intensity of attacks are included in the priority calculation to ensure that the scenario of "high vulnerability + high frequency attack" receives the highest priority, avoiding the waste of defense resources in low-risk scenarios. The attack frequency coefficient V is increased by 0.5 as the denominator to form the frequency correction term. After priority scaling, the priority calculation result is converted into an integer by rounding to the nearest integer, which is convenient for the defense system to identify and execute.

[0069] The iteration triggering logic for the threat correction component is as follows:

[0070] The threat mitigation component is triggered when any of the following conditions are met:

[0071] A: Dynamic defense priority P （k） ≥6;

[0072] B: Coordination coefficient K ≥ 1.5;

[0073] C: Hardware malfunction F≥1.0;

[0074] The iterative convergence logic is as follows: the iteration ends when the system satisfies any one of the following conditions:

[0075] D: The number of iterations k reaches 5;

[0076] E: The average defense effect remains unchanged after two consecutive iterations.

[0077] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A security defense processing system based on server host security, characterized by: Including data acquisition component, data processing component and defense processing component, the relevant data of server host running is acquired through data acquisition component, including abnormal identification data, threat quantization data and cooperative update data, and the collected data is input into data processing component, the data is cleaned through data processing component, and after cleaning, it is input into defense processing component; The defense processing component: Based on the current instruction cycle change amount, the historical reference instruction cycle change amount, the memory page error rate, the historical reference page error rate and the weight coefficient in the abnormal identification data, the hardware behavior fingerprint deviation degree is output, the bottom layer abnormality is identified through the hardware behavior fingerprint deviation degree, and the basis for threat quantization is provided; Based on the attack chain link threat score, the attack chain link weight, the asset value coefficient, the attack weapon coefficient, the cooperativity coefficient and the hardware behavior fingerprint deviation degree in the threat quantization data, the attack chain time sequence threat value is output, and the real-time threat degree of the current attack chain is quantized through the attack chain time sequence threat value; Based on the hardware behavior fingerprint deviation degree, the system vulnerability coefficient and the attack frequency coefficient in the abnormal identification data, and the attack chain time sequence threat value, the dynamic defense priority is output, and the defense emergency degree of the current attack is quantized through the dynamic defense priority; The security defense processing system also includes a threat correction component: based on the i-link defense effect, the average defense effect of all links and the iteration step in the cooperative update data, the attack chain link weight is iterated, and based on the path length coefficient, the cooperativity amplification factor and the transition probability of link j after the occurrence of attack link i in the cooperative update data, the cooperativity coefficient is iterated and corrected; According to the iterated cooperativity coefficient and the attack chain link weight, the attack chain time sequence threat value is recalculated, and until the iteration convergence condition is met, the stable strategy is output according to the dynamic defense priority.

2. The server-host-security-based security defense processing system of claim 1, wherein: The defense processing component includes an abnormal identification module, a threat quantization module and a priority judgment module.

3. The server-host-security-based security defense processing system of claim 2, wherein: The processing logic of the abnormal identification module is: The absolute deviation of the current instruction cycle change amount and the historical reference instruction cycle change amount is calculated, and the proportion of the absolute deviation in the reference value is calculated, which reflects the abnormal fluctuation degree of CPU operation efficiency, the absolute deviation of the memory page error rate and the historical reference page error rate is calculated, and the proportion of the absolute deviation in the reference value is calculated, which reflects the abnormal degree of memory access, and the deviation degrees of the two hardware indexes are integrated into a comprehensive value by using the weight coefficient, which reflects the contribution difference of different hardware indexes to abnormal identification; Through the instruction cycle fluctuation and the memory page error rate, the deviation degree of the server hardware running state and the historical reference is quantized, the invisible malicious program which is difficult to be detected by traditional software layer defense is identified, and the bottom layer abnormality basis for subsequent threat evaluation is provided.

4. The server-host-security-based security defense processing system of claim 3, wherein: The processing logic of the threat quantization module is: The threat scores of the three core attack links are weighted and summed, multiplied by the attack chain link weight of the kth iteration to obtain an attack chain basic threat value, and the hardware exception is associated with the attack chain threat to form a hardware exception amplification factor. The product of the asset value coefficient, the attack weapon coefficient and the synergy coefficient is combined as a scenario and synergy amplification factor to reflect the amplification effect of factor superposition. The real-time threat degree of the attack chain is dynamically quantified, not only considering the threat of a single attack link, but also integrating the hardware exception amplification effect, asset value, attack weapon destructive power and synergy attack amplification effect to solve the problem of "ignoring link correlation" in traditional attack chain threat assessment.

5. The server-host-security-based security defense processing system of claim 4, wherein: The processing logic of the priority determination module is: The attack chain threat value, hardware exception, system vulnerability and attack frequency are integrated into a dynamic defense priority to provide an emergency decision basis for the defense system and realize intelligent allocation of resources. The hardware behavior fingerprint deviation is added by 1 to amplify the priority weight of the hardware exception, and the product of the logarithmically processed attack chain timing threat value, system vulnerability coefficient and attack frequency coefficient is multiplied to form a priority core calculation item as the numerator. The attack frequency coefficient is added by 0.5 to form a frequency correction item as the denominator. After scaling the priority, the dynamic defense priority is obtained by rounding off.

6. The server-host-security-based security defense processing system of claim 5, wherein: The threat correction component includes a coefficient correction module and a weight correction module.

7. The server-host-security-based security defense processing system of claim 6, wherein: The correction logic of the coefficient correction module is: The transfer probability, the synergy amplification factor and the path length coefficient are multiplied to form a synergy attack amplification value, and the synergy attack amplification value is added by 1 to form a synergy coefficient. The threat amplification effect of continuous attacks is quantified to identify APT attacks with strong jumping and concealment, and to avoid underestimating the threat due to ignoring link correlation in traditional models.

8. The server-host-security-based security defense processing system of claim 7, wherein: The correction logic of the weight correction module is: The average defense effect of all links is subtracted from the defense effect of the ith link to form the numerator, and the average defense effect of all links is added by 0.1 to form the denominator to form a defense effect deviation rate item. After multiplication with the iteration step, 1 is added to form a weight adjustment factor item. The weight adjustment factor item is multiplied by the attack chain link weight of the kth iteration to obtain the attack chain link weight of the k+1th iteration. Through defense effect feedback, the weight of each link of the attack chain is dynamically adjusted to automatically tilt the defense resources to "weak defense links", and the defense strategy is self-optimized.

9. The server-host-security-based security defense processing system of claim 8, wherein: The iteration trigger logic of the threat correction component is: The threat correction component is triggered when any of the following conditions is met: A: The dynamic defense priority is greater than or equal to 6; B: The synergy coefficient is greater than or equal to 1.5; C: The hardware exception is greater than or equal to 1.

0. The iteration convergence logic of the threat correction component is that the iteration is ended when any of the following conditions is met: D: The number of iterations reaches 5 times; E: The average defense effect of two consecutive iterations is unchanged.

Images