Full-flow threat sensing and tracing system oriented to cloud native environment

Abstract

The invention belongs to the technical field of cloud native environments, and particularly relates to a cloud native environment-oriented full-flow threat sensing and tracing system, which comprises a data acquisition layer deployed on each computing node of a cloud native cluster and used for acquiring east-west network flow and north-south network flow; the data preprocessing and storage layer is connected with the data acquisition layer, and is used for performing analysis, specification and standardization processing on the acquired original traffic and storing the processed original traffic as a structured traffic log; the dynamic strategy engine is connected with the data preprocessing and storage layer and is used for generating and adjusting a security strategy based on a real-time flow analysis result; and carrying out visualization and traceability analysis. According to the invention, through multi-level data acquisition and fusion, all-around deep monitoring of network activities in a cloud native environment is realized, and specifically, an eBPF probe is deployed on a kernel layer of an operating system in a data acquisition layer, so that basic network connections and data packets of all Pods can be captured without invasion.

Description

Technical Field

[0001] This invention belongs to the field of cloud-native environment technology, specifically a full-traffic threat perception and tracing system for cloud-native environments. Background Technology

[0002] As enterprises deepen their digital transformation, cloud computing has become an important cornerstone of information technology, and cloud-native technology, with its core advantages of elastic scaling, agile deployment and microservices, is rapidly becoming the mainstream paradigm for building and running modern applications.

[0003] In traditional network environments, security protection mainly relies on static, boundary-based defense methods, such as firewalls and intrusion detection systems. These devices are usually deployed at fixed network entry and exit points and filter and control traffic through predefined rules and policies.

[0004] However, in cloud-native architectures, applications consist of thousands of microservices, and service instances are dynamically created and destroyed as the load changes. East-west traffic far exceeds north-south traffic, rendering traditional perimeter security models almost ineffective. The attack surface expands from finite boundary points to countless dynamically changing service endpoints, making attack paths more covert and complex. According to the authorized announcement number CN119675897A, a method and system for real-time perception, authentication, and tracing of encrypted communication threats is disclosed, relating to the field of communication threat perception technology. This includes collecting and parsing the behavioral characteristics of malicious encrypted traffic; analyzing threat events based on semantic analysis capabilities and analyzing the homology of multi-source, multi-dimensional threat intelligence data; and testing advanced threat dynamic defense capabilities based on mimicry defense, demonstrating the threat linkage handling and attack chain diagram of malicious encrypted traffic. The real-time perception, authentication, and tracing method for encrypted communication threats provided by this invention comprehensively identifies, monitors, detects, and analyzes encrypted covert traffic through threat event analysis based on semantic analysis capabilities, enhancing the ability to respond to advanced threat methods. It also performs homology analysis of multi-source, multi-dimensional threat intelligence data, improving the precision and effectiveness of intelligence. This invention achieves better results in terms of applicability, accuracy, and effectiveness.

[0005] Currently, existing security systems still have the following problems when facing security threats in cloud-native environments:

[0006] 1. Traditional security strategies are mostly statically configured. Once set, they are difficult to adjust in real time with changes in network status and application behavior. In cloud-native environments where microservice instances are frequently started and stopped and network topology changes rapidly, this one-size-fits-all strategy is extremely cumbersome and inefficient.

[0007] 2. The complexity of cloud-native environments is growing exponentially. The number of network connections, configuration items, and dependent services far exceeds that of traditional IT environments. Once a security incident or performance failure occurs, locating the root cause is like finding a needle in a haystack.

[0008] 3. In terms of visibility, traditional network traffic visualization tools are unable to depict the full picture of east-west communication between complex microservices within cloud-native environments. Administrators lack a unified, multi-dimensional perspective to intuitively perceive the overall network situation. In terms of threat analysis, after an attack is detected, reconstructing the attack chain and accurately tracing the attack source are key to containing the threat. However, due to the massive and dispersed nature of traffic data and the chain-like relationship between service calls, manual source tracing analysis becomes extremely difficult. Summary of the Invention

[0009] The purpose of this invention is to provide a full-traffic threat perception and tracing system for cloud-native environments to solve the problems mentioned in the background art.

[0010] To address the aforementioned problems, this invention provides a technical solution: a full-traffic threat perception and tracing system for cloud-native environments, the full-traffic threat perception and tracing system comprising:

[0011] The data acquisition layer is deployed on each compute node of the cloud-native cluster to collect network traffic in the east-west and north-south directions.

[0012] The data preprocessing and storage layer, connected to the data acquisition layer, is used to parse, reduce and standardize the acquired raw traffic, and store it as a structured traffic log.

[0013] A dynamic policy engine connects the data preprocessing and storage layer and is used to generate and adjust security policies based on real-time traffic analysis results.

[0014] The visualization and source tracing analysis layer provides a unified user interface for displaying network topology and security status, and supports interactive attack link tracing.

[0015] Preferably, the data acquisition layer includes:

[0016] The eBPF probe module is embedded in the host operating system as a kernel module. It is used to collect network connections, TCP / UDP packets and system call events of all Pods non-intrusively at the kernel level of the operating system.

[0017] The service mesh Sidecar proxy module is deployed in each Pod of the service mesh architecture. It is used to collect HTTP / gRPC request and response metadata between application layer microservices, including service identifier, API endpoint, status code and latency.

[0018] The data collected by the eBPF probe module and the Sidecar proxy module are fused through association fields, which include a 5-tuple and a timestamp, to form a unified network flow record. The 5-tuple specifically includes the source IP, destination IP, source port, destination port, and transport layer protocol.

[0019] Preferably, the data preprocessing and storage layer includes:

[0020] The traffic parsing and reduction module performs deep packet inspection on raw data packets, extracts application layer protocols and key fields, and reduces the raw flow records based on the following formula to generate concise logs per flow session:

[0021] Stream session identifier = Hash(source service identifier + destination service identifier + target API endpoint + time window number)

[0022] Where, time window number = timestamp / window size, unit: seconds, window size is configurable;

[0023] A graph database is used to store the reduced traffic logs. Services, Pods, and API endpoints are abstracted as nodes, and network communication is abstracted as edges. The attributes of the edges include request frequency, average latency, and error rate, thereby constructing a dynamic service dependency graph.

[0024] Preferably, the dynamic strategy engine includes:

[0025] The behavior baseline learning module is used to establish a normal communication behavior baseline for each microservice based on historical traffic data. The baseline is dynamically updated using the following algorithm:

[0026] The request frequency from service A to service B within time window t Its baseline Calculated using the weighted moving average method:

[0027] Where α is the smoothing coefficient, and its value ranges from (0, 1).

[0028] The strategy decision module is connected to the behavior baseline learning module and is used to compare the current traffic with the behavior baseline in real time. When the deviation exceeds the threshold, the network strategy is automatically generated or adjusted.

[0029] The formula for calculating the deviation δ is:

[0030] When δ > θ, θ is a preset threshold, which is judged as abnormal behavior and triggers the corresponding policy.

[0031] Preferably, the dynamic strategy engine further includes:

[0032] The policy execution interface interfaces with the network plugins or service mesh control plane APIs of cloud-native platforms to distribute security policies generated by the policy decision module into specific network policy rules in real time. These rules include, but are not limited to:

[0033] Traffic routing rules for Istio-Virtual Service or network isolation rules for Cilium Network Policy.

[0034] Preferably, the visualization and source tracing analysis layer includes:

[0035] The dynamic topology rendering module is used to read the service dependency graph from the graph database in real time and visualize it in the form of a force-directed graph. The node color or size changes according to the real-time traffic load or security status, and the edges are highlighted with different colors according to the health status of the communication. The health status is normal, warning, and abnormal.

[0036] Preferably, the visualization and source tracing analysis layer further includes:

[0037] The attack chain tracing module is used to automatically reconstruct the attack chain after an attack event is detected. The module is based on a graph database and executes a reverse depth-first search algorithm. Starting from the attacked target node, it traverses all possible call paths in reverse and filters them according to the temporal and causal relationships of the edges, and finally generates an attack path graph.

[0038] The causal relationship is confirmed by calculating the temporal proximity of the edges and the abnormality of the call frequency.

[0039] Preferably, when reconstructing the attack chain, the attack chain tracing module uses a confidence score-based algorithm to sort multiple potential paths. The confidence score (P) is calculated using the following formula:

[0040] Where P is the edge The path formed

[0041] For the edge The abnormal weight is calculated from the deviation δ of the edge in the current time window;

[0042] for The temporal weights ensure that the attack steps have a reasonable order in time.

[0043] Preferably, the system further includes:

[0044] A unified correlation analysis engine connects the data preprocessing and storage layers to perform correlation analysis on network traffic data and Pod lifecycle events and configuration change events collected from the cloud-native platform API server. This enables the rapid identification of security risks caused by configuration errors or abnormal Pod restarts during security incident localization.

[0045] Preferably, the unified association analysis engine employs an association rule mining algorithm, specifically the FP-Growth algorithm, to discover frequently co-occurring event sequence patterns in massive event data, thereby extracting typical configuration-deployment-network attack precondition sequences in cloud-native environments for predictive threat warning.

[0046] The beneficial effects of this invention are:

[0047] 1. This invention achieves comprehensive and in-depth monitoring of network activities in cloud-native environments through multi-layered data collection and fusion. Specifically, the data collection layer deploys an eBPF probe at the operating system kernel level, which can non-intrusively capture the basic network connections and data packets of all Pods. At the same time, at the application layer, through the service mesh Sidecar proxy integrated into each Pod, it specifically collects fine-grained HTTP or gRPC communication metadata between microservices. Finally, these two types of data are correlated and fused through key fields such as five-tuples and timestamps to form a unified and complete flow record covering the underlying network to the upper-layer application.

[0048] 2. This invention significantly improves the security adaptation and proactive defense capabilities of cloud-native environments through dynamic behavioral baselines and automated policy responses. The system first uses a behavioral baseline learning module to establish a dynamically updated normal communication mode baseline for each microservice based on historical traffic. Then, the policy decision module compares the current traffic with the baseline in real time. Once it finds that the deviation of indicators such as communication frequency exceeds a preset threshold, it is judged as abnormal behavior. The judgment result will immediately trigger policy generation, and through the policy execution interface, the security policy will be automatically converted into specific network isolation rules or service mesh traffic routing rules for the cloud-native platform. This achieves a fully automated closed loop from threat detection to policy execution, greatly shortening the security response time and enhancing the resilience of the environment.

[0049] 3. This invention greatly enhances the global awareness of security threats and the efficiency of post-incident investigation and analysis through visualized topology and intelligent attack chain tracing. The dynamic topology rendering module presents complex service dependencies in an intuitive force-directed graph, and makes the visual attributes of nodes and edges dynamically change with real-time load and health status, allowing operation and maintenance personnel to grasp the overall security situation at a glance. When an attack occurs, the attack chain tracing module can, based on the graph database, traverse backward from the victim node and filter all possible call paths. By comprehensively calculating the weight of communication anomalies and the rationality of the timing, it sorts multiple potential attack paths by confidence, and finally quickly and accurately reconstructs the complete attack chain, providing a clear and reliable decision-making basis for the security team to determine responsibility for incidents and respond to emergencies. Attached Figure Description

[0050] For ease of explanation, the present invention will be described in detail below with reference to specific embodiments and accompanying drawings.

[0051] Figure 1 This is a flowchart of the full-traffic threat perception and tracing system of the present invention. Detailed Implementation

[0052] Example 1

[0053] like Figure 1 As shown, this specific implementation adopts the following technical solution: a full-traffic threat perception and tracing system for cloud-native environments, the full-traffic threat perception and tracing system comprising:

[0054] The data acquisition layer is deployed on each compute node of the cloud-native cluster to collect network traffic in the east-west and north-south directions.

[0055] The data preprocessing and storage layer connects to the data acquisition layer and is used to parse, reduce, and standardize the acquired raw traffic, and store it as a structured traffic log.

[0056] The dynamic policy engine connects the data preprocessing and storage layers, and is used to generate and adjust security policies based on real-time traffic analysis results.

[0057] The visualization and source tracing analysis layer provides a unified user interface for displaying network topology and security status, and supports interactive attack link tracing.

[0058] The data acquisition layer includes:

[0059] The eBPF probe module is embedded in the host operating system as a kernel module. It is used to collect network connections, TCP / UDP packets and system call events of all Pods non-intrusively at the kernel level of the operating system.

[0060] The service mesh Sidecar proxy module is deployed in each Pod of the service mesh architecture. It is used to collect HTTP / gRPC request and response metadata between application layer microservices, including service identifier, API endpoint, status code and latency.

[0061] The data collected by the eBPF probe module and the Sidecar proxy module are fused through association fields, which include a 5-tuple and a timestamp, to form a unified network flow record. The 5-tuple specifically consists of source IP, destination IP, source port, destination port, and transport layer protocol.

[0062] The data preprocessing and storage layer includes:

[0063] The traffic parsing and reduction module performs deep packet inspection on raw data packets, extracts application layer protocols and key fields, and reduces the raw flow records based on the following formula to generate concise logs per flow session:

[0064] Stream session identifier = Hash(source service identifier + destination service identifier + target API endpoint + time window number)

[0065] Where, time window number = timestamp / window size, unit: seconds, window size is configurable;

[0066] A graph database is used to store the reduced traffic logs. Services, Pods, and API endpoints are abstracted as nodes, and network communication is abstracted as edges. The attributes of the edges include request frequency, average latency, and error rate, thereby constructing a dynamic service dependency graph.

[0067] The dynamic strategy engine includes:

[0068] The behavior baseline learning module is used to establish a normal communication behavior baseline for each microservice based on historical traffic data. The baseline is dynamically updated using the following algorithm:

[0069] The request frequency from service A to service B within time window t Its baseline Calculated using the weighted moving average method:

[0070] Where α is the smoothing coefficient, and its value ranges from (0, 1).

[0071] The strategy decision module connects to the behavior baseline learning module and is used to compare the current traffic with the behavior baseline in real time. When the deviation exceeds the threshold, the network strategy is automatically generated or adjusted.

[0072] The formula for calculating the deviation δ is:

[0073] When δ > θ, θ is a preset threshold, which is judged as abnormal behavior and triggers the corresponding policy.

[0074] The dynamic strategy engine also includes:

[0075] The policy execution interface interfaces with the network plugins or service mesh control plane APIs of cloud-native platforms to distribute security policies generated by the policy decision module into specific network policy rules in real time. These rules include, but are not limited to:

[0076] Traffic routing rules for Istio-VirtualService or network isolation rules for CiliumNetworkPolicy.

[0077] The visualization and source tracing analysis layer includes:

[0078] The dynamic topology rendering module is used to read the service dependency graph from the graph database in real time and visualize it in the form of a force-directed graph. The node color or size changes according to the real-time traffic load or security status, and the edges are highlighted with different colors according to the health status of the communication, which is normal, warning, and abnormal.

[0079] The visualization and source tracing analysis layer also includes:

[0080] The attack chain tracing module is used to automatically reconstruct the attack chain after an attack event is detected. The module is based on a graph database and executes a reverse depth-first search algorithm. Starting from the attacked target node, it traverses all possible call paths in reverse and filters them according to the temporal and causal relationships of the edges, and finally generates an attack path graph.

[0081] Causality is confirmed by calculating the temporal proximity of edges and the frequency of call anomalies.

[0082] The attack chain tracing module, when reconstructing the attack chain, uses a confidence score-based algorithm to rank multiple potential paths. The formula for calculating the confidence score (P) is as follows:

[0083] Where P is the edge The path formed

[0084] For the edge The abnormal weight is calculated from the deviation δ of the edge in the current time window;

[0085] for The temporal weights ensure that the attack steps have a reasonable order in time.

[0086] The system also includes:

[0087] The unified correlation analysis engine connects the data preprocessing and storage layers to perform correlation analysis on network traffic data and Pod lifecycle events and configuration change events collected from the cloud-native platform API server. This enables the rapid identification of security risks caused by configuration errors or abnormal Pod restarts during security incident localization.

[0088] Among them, the unified association analysis engine adopts an association rule mining algorithm, specifically the FP-Growth algorithm, to discover frequently co-occurring event sequence patterns in massive event data, thereby extracting typical configuration-deployment-network attack and precondition sequences in cloud-native environments for predictive threat warning.

[0089] Example 2

[0090] The workflow of a full-traffic threat awareness and tracing system for cloud-native environments is as follows:

[0091] S1, Full Flow Data Acquisition

[0092] On each compute node of the cloud-native cluster, network connections, data packets and system call events at the kernel layer are collected through eBPF probes, while HTTP / gRPC metadata at the application layer is collected in the Sidecar agent of each Pod.

[0093] S2, Multi-source data fusion

[0094] The data collected by the eBPF probe and the Sidecar agent are correlated and fused using quintuples and timestamps to form a unified network flow record;

[0095] S3, Traffic Resolution and Regulation

[0096] Deep packet inspection is performed on the raw traffic to extract application layer protocols and key fields. The flow records are reduced according to a preset time window to generate concise logs based on flow sessions and stored in the graph database.

[0097] S4. Construct a service dependency graph

[0098] In the graph database, services, Pods, and API endpoints are abstracted as nodes, and network communication is abstracted as edges. A service dependency graph is dynamically constructed based on the reduced traffic logs, and edge attributes include request frequency, latency, error rate, etc.

[0099] S5, Behavioral Baseline Learning and Anomaly Detection

[0100] Based on historical traffic data, a weighted moving average algorithm is used to establish a communication behavior baseline for each microservice. The deviation of the current traffic from the baseline is calculated in real time, and if it exceeds the threshold, it is judged as abnormal.

[0101] S6. Dynamic Strategy Generation and Distribution

[0102] When abnormal behavior is detected, security policies, such as traffic routing or network isolation rules, are automatically generated and distributed to the cloud-native platform network plugin or service mesh control plane in real time through the policy execution interface.

[0103] S7, Unified Association Analysis

[0104] By correlating network traffic data with Pod lifecycle events and configuration change events, and using the FP-Growth algorithm to mine frequently co-occurring event sequence patterns, predictive threat warnings can be achieved.

[0105] S8, Visualized Source Tracing and Attack Link Reconstruction

[0106] The service dependency topology is rendered in real time through force-directed graphs, dynamically reflecting the security status; for attack events, a reverse depth-first search is performed based on the graph database, and an attack path graph is generated by sorting by confidence score, supporting interactive source tracing analysis.

[0107] Example 3

[0108] Implementation Scenario: Microservice Security Protection for an E-commerce Platform

[0109] 1. Background

[0110] The platform uses a Kubernetes cluster to deploy hundreds of microservices, such as user management, order processing, and payment services, and manages inter-service communication through a service mesh.

[0111] We face the risk of internal attacks via east-west traffic, such as abnormal calls between services and data leaks, as well as external attacks via north-south traffic, such as malicious API access.

[0112] 2. System Deployment and Data Acquisition

[0113] Data Acquisition Layer: Deploy eBPF probes on each Kubernetes node to collect network connections, data packets, and system calls of all Pods;

[0114] Inject a Sidecar proxy into each Pod to collect application-layer HTTP / gRPC metadata, such as service name user-service, API endpoint / api / payment, status code 500, and latency 120ms.

[0115] By associating eBPF and Sidecar data through a 5-tuple and timestamp, they are merged into a unified stream record. For example, it can be used to identify abnormally high frequency gRPC calls originating from a compromised Pod.

[0116] 3. Traffic processing and storage

[0117] Traffic parsing and specifications:

[0118] Perform deep packet inspection on the raw traffic to extract fields such as HTTP headers and gRPC method names;

[0119] Record streams according to time windows and generate session logs;

[0120] For example:

[0121] Stream Session ID=

[0122] Hash("user-service"+"payment-service"+" / api / transfer"+"window number");

[0123] Graph database storage:

[0124] Abstract services, Pods, and APIs as nodes, and communication relationships as edges to build a dynamic dependency graph;

[0125] For example:

[0126] Edge attributes: Request frequency, average latency, and error rate for the order service → inventory service;

[0127] 4. Dynamic strategy engine response error

[0128] Behavioral baseline learning:

[0129] Establish a normal traffic baseline for each service;

[0130] For example:

[0131] The baseline request frequency for payment services → risk control services is 200 times / minute, with α=0.2 dynamically updated.

[0132] Anomaly detection and strategy generation:

[0133] Real-time detection showed a sudden increase in the frequency of payment service → risk control service requests to 1000 times / minute, with a deviation of δ=4 and a threshold of θ=2, which was determined to be a credential stuffing attack.

[0134] The strategy decision-making module automatically generates the following rule: Limit the frequency of calls from the payment service to the risk control service to ≤300 times / minute;

[0135] Strategy execution:

[0136] Traffic circuit breaking can be achieved by issuing VirtualService to Istio through the policy execution interface, or by issuing NetworkPolicy to isolate abnormal Pods through Cilium;

[0137] 5. Visualization and Attack Tracing

[0138] Dynamic topology rendering:

[0139] The UI uses a force-directed graph to display service dependencies, with node colors changing according to real-time load and edge colors marked according to error rate.

[0140] Attack chain tracing:

[0141] When the database service is subjected to a brute-force attack, the attack chain tracing module traverses backwards from that node:

[0142] Based on time series and anomaly weights, such as a filtering path with a deviation of δ=3.5 on a certain side;

[0143] Restore the complete path: External IP → Gateway Pod → Authentication Service → Database Service;

[0144] The attack chains with the highest probability are displayed first by sorting the paths according to their confidence scores.

[0145] 6. Unified Association Analysis

[0146] Related cloud platform events:

[0147] When abnormal traffic is detected, the K8s API server event is correlated, and it is found that the Pod configuration was modified before the attack.

[0148] Use the FP-Growth algorithm to discover frequent event patterns, for example:

[0149] Pattern: ConfigMap change → Pod restart → Abnormal external connection, triggering predictive alerts.

[0150] The innovation of this invention lies in its comprehensive and non-intrusive data capture and fusion achieved through a data acquisition layer. This acquisition layer is deployed on each computing node of the cloud-native cluster and specifically includes two core modules: an eBPF probe module embedded in the host operating system as a kernel module, capable of non-intrusively collecting network connections, TCP / UDP packets, and system call events of all Pods at the operating system kernel level; and a service mesh Sidecar proxy module deployed in each Pod of the service mesh architecture, specifically collecting HTTP / gRPC request and response metadata between application-layer microservices, including key information such as service identifiers, API endpoints, status codes, and latency. The data collected by these two modules are deeply fused through correlation fields, which include a five-tuple: source IP, destination IP, source port, destination port, transport layer protocol, and timestamp, thereby forming a unified network flow record and providing a complete data foundation for subsequent analysis.

[0151] Intelligent security policy generation and adjustment are achieved through a dynamic policy engine. This engine connects the data preprocessing and storage layers. Its behavior baseline learning module establishes a normal communication behavior baseline for each microservice based on historical traffic data and dynamically updates the baseline value using a weighted moving average algorithm. For example, for the request frequency from service A to service B within a time window t, the baseline is adaptively adjusted by weighting the calculation through a smoothing coefficient. The policy decision module compares the current traffic with the behavior baseline in real time. When the deviation exceeds a preset threshold, the policy response is automatically triggered. The deviation is calculated based on the relative difference between the current value and the baseline value. The policy execution interface interfaces with the network plugin or service mesh control plane API of the cloud-native platform to distribute the generated security policy as specific network policy rules in real time, including traffic routing rules of Istio Virtual Service or network isolation rules of Cilium Network Policy, forming a complete detection-decision-execution closed loop.

[0152] The visualization and tracing analysis layer provides in-depth security situation awareness and attack analysis capabilities. The dynamic topology rendering module reads the service dependency graph from the graph database in real time and visualizes it in the form of a force-directed graph. The node color or size changes dynamically according to the real-time traffic load or security status, and the edges are highlighted with different colors according to the health status of the communication. After detecting an attack event, the attack link tracing module executes a reverse depth-first search algorithm based on the graph database. Starting from the attacked target node, it traverses all possible call paths in reverse and confirms the causal relationship by calculating the temporal proximity of the edges and the abnormality of the call frequency. This module uses an algorithm based on confidence scoring to sort multiple potential paths. The confidence score comprehensively considers the abnormal weight and temporal weight of each edge to ensure that the final generated attack path graph conforms to both abnormal characteristics and time series logic, thereby achieving accurate attack link reconstruction.

[0153] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the present invention. Various changes and modifications can be made to the present invention without departing from its spirit and scope. All such changes and modifications fall within the scope of the present invention as claimed, which is defined by the appended claims and their equivalents.

Claims

1. A full-traffic threat perception and tracing system for cloud-native environments, characterized in that, The full-traffic threat perception and tracing system includes: The data acquisition layer is deployed on each compute node of the cloud-native cluster to collect network traffic in the east-west and north-south directions. The data preprocessing and storage layer, connected to the data acquisition layer, is used to parse, reduce and standardize the acquired raw traffic, and store it as a structured traffic log. A dynamic policy engine connects the data preprocessing and storage layer and is used to generate and adjust security policies based on real-time traffic analysis results. The visualization and source tracing analysis layer provides a unified user interface for displaying network topology and security status, and supports interactive attack link tracing.

2. The full-traffic threat perception and tracing system for cloud-native environments according to claim 1, characterized in that: The data acquisition layer includes: The eBPF probe module is embedded in the host operating system as a kernel module. It is used to collect network connections, TCP / UDP packets and system call events of all Pods non-intrusively at the kernel level of the operating system. The service mesh Sidecar proxy module is deployed in each Pod of the service mesh architecture. It is used to collect HTTP / gRPC request and response metadata between application layer microservices, including service identifier, API endpoint, status code and latency. The data collected by the eBPF probe module and the Sidecar proxy module are fused through association fields, which include a 5-tuple and a timestamp, to form a unified network flow record. The 5-tuple specifically includes the source IP, destination IP, source port, destination port, and transport layer protocol.

3. The full-traffic threat perception and tracing system for cloud-native environments according to claim 2, characterized in that: The data preprocessing and storage layer includes: The traffic parsing and reduction module performs deep packet inspection on raw data packets, extracts application layer protocols and key fields, and reduces the raw flow records based on the following formula to generate concise logs per flow session: Stream session identifier = Hash(source service identifier + destination service identifier + target API endpoint + time window number) Where, time window number = timestamp / window size, unit: seconds, window size is configurable; A graph database is used to store the reduced traffic logs. Services, Pods, and API endpoints are abstracted as nodes, and network communication is abstracted as edges. The attributes of the edges include request frequency, average latency, and error rate, thereby constructing a dynamic service dependency graph.

4. The full-traffic threat perception and tracing system for cloud-native environments according to claim 3, characterized in that: The dynamic strategy engine includes: The behavior baseline learning module is used to establish a normal communication behavior baseline for each microservice based on historical traffic data. The baseline is dynamically updated using the following algorithm: The request frequency from service A to service B within time window t Its baseline Calculated using the weighted moving average method: Where α is the smoothing coefficient, and its value ranges from (0, 1). The strategy decision module is connected to the behavior baseline learning module and is used to compare the current traffic with the behavior baseline in real time. When the deviation exceeds the threshold, the network strategy is automatically generated or adjusted. Deviation δ The calculation formula is as follows: when δ When the value is greater than θ, θ is a preset threshold, which is judged as abnormal behavior and triggers the corresponding policy.

5. A full-traffic threat perception and tracing system for cloud-native environments according to claim 4, characterized in that: The dynamic strategy engine also includes: The policy execution interface interfaces with the network plugins or service mesh control plane APIs of cloud-native platforms to distribute security policies generated by the policy decision module into specific network policy rules in real time. These rules include, but are not limited to: Traffic routing rules for Istio-Virtual Service or network isolation rules for Cilium Network Policy.

6. A full-traffic threat perception and tracing system for cloud-native environments according to claim 5, characterized in that: The visualization and source tracing analysis layer includes: The dynamic topology rendering module is used to read the service dependency graph from the graph database in real time and visualize it in the form of a force-directed graph. The node color or size changes according to the real-time traffic load or security status, and the edges are highlighted with different colors according to the health status of the communication. The health status is normal, warning, and abnormal.

7. A full-traffic threat perception and tracing system for cloud-native environments according to claim 6, characterized in that: The visualization and source tracing analysis layer also includes: The attack chain tracing module is used to automatically reconstruct the attack chain after an attack event is detected. The module is based on a graph database and executes a reverse depth-first search algorithm. Starting from the attacked target node, it traverses all possible call paths in reverse and filters them according to the temporal and causal relationships of the edges, and finally generates an attack path graph. The causal relationship is confirmed by calculating the temporal proximity of the edges and the abnormality of the call frequency.

8. A full-traffic threat perception and tracing system for cloud-native environments according to claim 7, characterized in that: When reconstructing the attack chain, the attack chain tracing module uses a confidence score-based algorithm to sort multiple potential paths. The confidence score (P) is calculated using the following formula: Where P is the edge The path formed For the edge The abnormal weight is determined by the deviation of the edge within the current time window. δ Calculated; for The temporal weights ensure that the attack steps have a reasonable order in time.

9. A full-traffic threat perception and tracing system for cloud-native environments according to claim 8, characterized in that: The system also includes: A unified correlation analysis engine connects the data preprocessing and storage layers to perform correlation analysis on network traffic data and Pod lifecycle events and configuration change events collected from the cloud-native platform API server. This enables the rapid identification of security risks caused by configuration errors or abnormal Pod restarts during security incident localization.

10. A full-traffic threat perception and tracing system for cloud-native environments according to claim 9, characterized in that: The unified association analysis engine employs an association rule mining algorithm, specifically the FP-Growth algorithm, to discover frequently co-occurring event sequence patterns in massive event data. This allows for the extraction of typical configuration-deployment-network attack precondition sequences in cloud-native environments, which are used for predictive threat warnings.

Images