Server security protection method and system

Abstract

The invention relates to the technical field of server security protection, and discloses a server security protection method and system. The method comprises the following steps: executing dynamic tracking of a server running state to obtain running data; performing protocol behavior collaborative analysis on the tracking result to generate a protocol interaction map representing a complex calling relationship between services; performing multi-level security threat assessment based on the map, and identifying an abnormal interaction mode deviating from a normal baseline; positioning a core risk area, performing real-time protection strategy adaptation, and generating a dynamic security strategy instruction; and finally executing the instruction to complete safety protection. According to the method, conversion from isolated event analysis to system relation modeling is realized by constructing the protocol interaction atlas, so that a complex attack chain can be accurately identified; through dynamic strategy adaptation based on a graph structure, protection upgrading from extensive blocking to accurate minimization intervention is realized, the threat detection capability is improved, and the service continuity is guaranteed.

Description

Technical Field

[0001] This invention relates to the field of server security protection technology, specifically to a server security protection method and system. Background Technology

[0002] With cloud computing and microservice architectures becoming mainstream, service interactions within servers exhibit high dynamism and complexity. A single external request can trigger complex cross-network and host communications between multiple components, including load balancers, application services, and databases. Current mainstream server security technologies primarily rely on layered and independent detection methods.

[0003] This divide-and-conquer strategy has limitations. Various security components operate independently, creating data silos, making it difficult to effectively correlate cross-layer, multi-protocol anomalies targeting a single attack chain. Security analysts must manually compare alert logs from different systems, which is inefficient and makes it difficult to identify advanced threats such as slow, lateral movement. Existing detection models lack the ability to globally describe dynamic dependencies between services, failing to effectively capture complex attack patterns that appear normal at a single point but are abnormal in their collaborative interactions.

[0004] The core challenge facing current technologies lies in achieving collaborative perception and precise response to cross-protocol behavior. Existing threat assessment solutions are often based on isolated events, resulting in relatively coarse protection and response strategies. For example, excessive measures such as blocking entire machines after discovering abnormal IPs can easily harm normal services. This profoundly reflects the disconnect between static protection strategies and dynamic risk situations, necessitating a new method that can accurately characterize the internal interactions of the system and thereby achieve dynamic and refined protection. Summary of the Invention

[0005] The purpose of this invention is to provide a server security protection method and system to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides a server security protection method, the method comprising:

[0007] Perform dynamic tracking of server running status and obtain the results of dynamic tracking of server running status;

[0008] The protocol behavior collaborative analysis is performed on the dynamic tracking results of the server's operating status to generate a protocol interaction graph;

[0009] Perform multi-level security threat assessment based on the protocol interaction graph and identify abnormal interaction patterns;

[0010] Based on the aforementioned abnormal interaction patterns, risk areas are located, and core risk areas are identified.

[0011] Real-time protection strategy adaptation is performed for the core risk areas to generate dynamic security policy instructions;

[0012] The dynamic security policy instructions are executed to complete the server security protection process.

[0013] Preferably, the server runtime status is dynamically tracked, and the results of the dynamic tracking are obtained, specifically including:

[0014] The system call sequence is collected in real time by a monitoring agent deployed on the server node to generate a raw behavioral data stream;

[0015] The original behavioral data stream is divided into time windows, and behavioral segments based on sliding time windows are extracted.

[0016] For each of the behavioral segments, feature quantization is performed, and the statistical feature vector of the behavioral segment is calculated;

[0017] The statistical feature vectors of continuous time windows are combined to form the dynamic tracking results of server operating status.

[0018] Preferably, the protocol behavior collaborative analysis is performed on the dynamic tracking results of the server's operating status to generate a protocol interaction graph, specifically including:

[0019] Analyze the network protocol data packets in the dynamic tracking results of the server's running status and extract protocol interaction features;

[0020] Establish a mapping relationship between protocol interaction characteristics and system call sequences, and construct a protocol behavior correlation matrix;

[0021] The protocol behavior correlation matrix is ​​analyzed topologically using a graph structure algorithm to generate a protocol interaction graph containing nodes and edges.

[0022] In the protocol interaction graph, nodes represent protocol interaction entities, and edges represent protocol interaction relationships.

[0023] The topological analysis of the protocol behavior association matrix using a graph structure algorithm specifically includes: converting the protocol behavior association matrix into a directed weighted graph structure, where the nodes of the graph correspond to protocol interaction entities, the edges of the graph correspond to protocol interaction relationships, and the edge weights are assigned based on the protocol interaction frequency and data volume; applying a community detection algorithm to partition the directed weighted graph into communities, identifying tightly connected community structures; calculating the centrality indices of each node, including degree centrality, betweenness centrality, and proximity centrality, to assess the importance of the node in protocol interactions; generating a topological feature descriptor for the protocol interaction graph based on the community structure and node centrality indices; and normalizing the topological feature descriptor to form a standardized protocol interaction graph.

[0024] Preferably, a multi-level security threat assessment is performed based on the protocol interaction graph to identify abnormal interaction patterns, specifically including:

[0025] The protocol interaction graph is subjected to community discovery processing to divide the protocol interaction communities;

[0026] Calculate the internal connection density and cross-community connection strength for each protocol interaction community;

[0027] A baseline model is established based on historical normal interaction patterns, and the characteristics of the current protocol interaction community are compared with the baseline model.

[0028] When abnormal fluctuations in internal connection density or cross-community connection strength are detected, it is marked as an abnormal interaction mode.

[0029] Preferably, risk area location is performed based on the abnormal interaction pattern to determine the core risk area, specifically including:

[0030] Extract the protocol interaction entities involved in the abnormal interaction patterns to generate a risk entity set;

[0031] Analyze the spatiotemporal correlations among the aforementioned risk entity set to construct risk propagation paths;

[0032] The threat level score for each risk propagation path is calculated using a risk assessment algorithm;

[0033] The areas corresponding to risk propagation paths whose threat level scores exceed a predetermined threshold are selected as core risk areas.

[0034] Preferably, real-time protection strategy adaptation is performed on the core risk areas to generate dynamic security policy instructions, specifically including:

[0035] Obtain real-time operating parameters of the core risk areas, including resource utilization and network connection status;

[0036] Based on the real-time operating parameters, a basic protection strategy is matched from the strategy library;

[0037] The parameters of the basic protection strategy are adjusted based on the characteristics of the abnormal interaction mode to generate an optimized protection strategy.

[0038] The optimized protection strategy is transformed into executable security policy instructions, forming dynamic security policy instructions.

[0039] Preferably, executing the dynamic security policy instructions to complete server security protection processing specifically includes:

[0040] Distribute the dynamic security policy instructions to the corresponding security execution components;

[0041] The target protocol interaction is shaped using a secure execution component.

[0042] Monitor protocol interaction behavior after traffic shaping and collect feedback data;

[0043] The basic protection strategy parameters in the strategy library are updated based on the feedback data.

[0044] Preferably, the step of establishing a baseline model based on historical normal interaction patterns and comparing the current protocol interaction community characteristics with the baseline model specifically includes:

[0045] Collect protocol interaction data during normal operation in history, and extract characteristic parameters of the protocol interaction community, including community size, internal connection density and cross-community connection strength;

[0046] Statistical learning methods are used to fit the distribution of historical feature parameters to establish a baseline probability model, which includes the normal range of feature parameters and their time variation patterns.

[0047] The feature parameters of the protocol interaction community are extracted in real time from the current protocol interaction graph to form the current feature vector;

[0048] Calculate the Mahalanobis distance between the current feature vector and the baseline probability model as a measure of anomaly bias;

[0049] When the Mahalanobis distance exceeds the preset confidence interval, it is determined that the current protocol interaction community characteristics are significantly different from the baseline model and are marked as an abnormal interaction mode.

[0050] Preferably, the step of calculating the threat level score for each risk propagation path using a risk assessment algorithm specifically includes:

[0051] Analyze the components of the risk propagation path, including path length, types of nodes traversed, and types of interaction protocols.

[0052] Risk weight coefficients are assigned to each component, where the node type weight is determined based on the node centrality index, and the interaction protocol category weight is determined based on the protocol security level.

[0053] The initial threat score of the risk propagation path is calculated using a weighted summation algorithm. The formula is the sum of the products of the risk value of each element and its corresponding weight.

[0054] A time decay factor is introduced to dynamically adjust the initial threat score, with the most recent interaction events having a higher risk contribution.

[0055] The threat score is normalized based on real-time network environment parameters to generate a standardized threat level score.

[0056] Preferably, the present invention also includes a server security protection system, the system including a memory, a processor, and a computer program stored in the memory and running on the processor, wherein when the processor executes the computer program, it implements the steps of the server security protection method described above.

[0057] Compared with the prior art, the beneficial effects of the present invention are:

[0058] By conducting collaborative analysis of protocol behavior on multi-source heterogeneous data on server operational status, a protocol interaction graph that intuitively reflects the call relationships between services is constructed. This method integrates scattered network traffic, system calls, and other information into a unified topology model, breaking through the data barriers of traditional single-point detection. The graph structure allows the dynamic dependencies between service components to be explicitly expressed, providing a global perspective for security analysis. This shift from isolated event analysis to system relationship modeling lays the data foundation for deep threat identification.

[0059] This model employs a multi-level security threat assessment based on protocol interaction graphs, identifying abnormal interaction patterns by analyzing the dynamic changes in the graph structure. The detection mechanism no longer relies on static rules but instead captures topological features such as abnormal connections between nodes and fluctuations in edge attributes. This model can detect threats that appear normal at a single point level but are anomalous in collaborative relationships. The focus of detection shifts from independent indicators to relationship deviations, enhancing the ability to perceive complex attack chains.

[0060] By identifying core risk areas based on anomaly patterns and generating dynamic security policy instructions, protective measures can be precisely adapted. Response strategies are customized based on the specific form of the anomaly in the security graph, allowing for precise location of specific services or communication links. This approach enables minimal intervention for risk areas. The protection mechanism shifts from a coarse-grained response to precise control, maximizing business continuity while containing threats. Attached Figure Description

[0061] Figure 1 This is a schematic diagram illustrating the working principle of the server security protection method described in this invention.

[0062] Figure 2 A flowchart for dynamically tracking the server's running status;

[0063] Figure 3 A flowchart for identifying anomalous interaction patterns in multi-level security threat assessment;

[0064] Figure 4 A diagram illustrating the security status of the protocol interaction community;

[0065] Figure 5 This is a threat level assessment map of risk propagation paths. Detailed Implementation

[0066] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0067] Please see Figure 1 This invention relates to a server security protection method and system. The following detailed description of the invention illustrates the following steps: Dynamic tracking of server operation status is performed by collecting raw data such as system call sequences in real time through monitoring agents deployed on server nodes. After processing, tracking results reflecting the server's dynamic behavior are obtained. Protocol behavior collaborative analysis is performed on the dynamic tracking results. By parsing network protocol data packets and establishing their association with system calls, a protocol interaction graph that visually displays protocol interaction entities and their relationships is generated. Multi-level security threat assessment is performed based on the protocol interaction graph. By analyzing features such as community structure and connection density and comparing them with historical baselines, abnormal interaction patterns deviating from normal patterns are identified. Risk areas are located based on the identified abnormal interaction patterns. The correlation and propagation path of risk entities are analyzed to determine the core risk area with the highest threat level. Real-time protection strategy adaptation is performed for the core risk area. Based on the real-time operating parameters and abnormal characteristics of the area, dynamic security policy instructions are generated by matching and optimizing from the policy library. The dynamic security policy instructions are executed, distributing the policies to security components to perform operations such as traffic shaping, and monitoring feedback data to update the policy library, thereby completing a complete server security protection processing cycle.

[0068] Example 1: See Figure 2 In practice, the dynamic tracking of server operating status relies on monitoring agents deployed on various physical or virtual nodes of the server. These agents run as daemons in the background of the operating system, minimizing system resource overhead and ensuring no significant impact on the performance of normal business applications running on the server. The core function of the monitoring agent is to collect system call sequences generated by the operating system kernel in real time. These sequences include event records of core operations such as process management, file system operations, network communication, and device input / output. These event records are arranged in strict chronological order, forming a continuous stream of raw behavioral data. This raw behavioral data stream is stored as log information in binary or structured text format. Each record contains a precise timestamp, process identifier, system call number, call parameters, and return value.

[0069] In practice, preprocessing the raw behavioral data stream is a necessary step. Preprocessing operations include invalid data filtering, format standardization, and field extraction. Specifically, a sliding window mechanism is used to divide the preprocessed raw behavioral data stream into time windows. The sliding time window has a fixed duration, and its length must balance the integrity of the behavioral pattern with the real-time performance of the detection; for example, a window length of 5 seconds can be used. The sliding time window's step size is smaller than the window length, for example, set to 2.5 seconds. This results in a 50% overlap between adjacent time windows. This overlap effectively prevents a complete behavioral pattern from being forcibly fragmented by the window boundaries, ensuring that each behavioral segment contains a relatively independent and complete operation sequence. All system call events captured within each time window constitute a behavioral segment, which is the basic unit for subsequent feature extraction.

[0070] In practical implementation, feature quantization of each behavioral segment is a crucial process for transforming unstructured sequence data into structured numerical features. Feature quantization calculates the multi-dimensional attributes of system call events within a behavioral segment, generating a statistical feature vector for that segment. The dimensions of the statistical feature vector are predefined, and each element represents a specific statistic for the behavioral segment. In practice, the calculated statistical features include the frequency distribution of system call types (the number of times or percentage of system calls with different numbers appear in the segment); the entropy of the system call sequence, used to quantify the randomness or uncertainty of the sequence; statistical information on the duration of system calls, including the mean, maximum, minimum, and standard deviation; and the frequency of occurrence of specific system call sequence patterns, such as consecutive file open and write operation pairs. The feature quantization process is implemented by calling a predefined feature calculation function library, which contains efficient algorithmic implementations for various statistics.

[0071] The statistical feature vectors of continuous time windows are combined to form the dynamic tracking results of server operation status. The combination process arranges the statistical feature vectors corresponding to each window in chronological order, forming a two-dimensional matrix data structure. In this matrix, each row represents the statistical feature vector of a time window, and each column represents the sequence of changes of a specific statistical feature over time. The dynamic tracking result matrix of server operation status constitutes a time-series representation of server behavior in a multi-dimensional feature space. It can be understood that the dynamic tracking result matrix of server operation status can be directly stored in memory for real-time analysis, or persisted to a disk database for historical querying and backtracking. The dynamic tracking results of server operation status provide a standardized and quantified input data foundation for the subsequent collaborative analysis phase of protocol behavior.

[0072] The data collection granularity of the monitoring agent can be configured. For example, it can be configured to collect all system calls or only a subset of specific system calls related to network communication or file access. In practice, the length of the time window and the sliding step are also configurable parameters, which system administrators can adjust according to the specific business load characteristics of the protected server and the real-time requirements of security monitoring. Optionally, for servers with frequently changing behavioral loads, a shorter time window can be used to improve detection sensitivity; for servers with relatively stable loads, a longer time window can be used to obtain a more stable overview of behavioral patterns.

[0073] In practical implementation, the feature quantization process can also include feature standardization or normalization steps to eliminate the impact of differences in feature dimensions. For example, frequency values ​​can be normalized to the [0,1] interval, or duration values ​​can be Z-score standardized. Feature standardization allows subsequent analysis algorithms to treat each feature dimension equally, preventing certain features with large numerical ranges from dominating the entire analysis process. Optionally, feature selection algorithms can be applied to statistical feature vectors to filter out the subset of features most relevant to security threats from a large number of initially calculated features, thereby reducing data dimensionality and computational complexity. It is understandable that the accuracy and reliability of dynamic tracking results of server operation status directly depend on the completeness of the data collected by the monitoring agent and the rationality of the feature quantization process. Therefore, the monitoring agent needs sufficient permissions to capture system call events while avoiding interference or termination by malware. The feature quantization scheme needs to be able to fully capture feature changes in server behavior patterns, thereby providing an effective basis for anomaly detection.

[0074] Example 2: In practical implementation, parsing the network protocol data packets in the dynamic tracking results of server operation status is the initial step. The dynamic tracking results typically contain raw network traffic metadata obtained through network sniffers or the server's local network stack logs. The parsing process requires identifying and extracting key network protocol interaction features. For example, for a TCP / IP protocol data packet, it is necessary to extract information such as the source IP address (e.g., 192.168.1.10), destination IP address (e.g., 10.0.0.5), source port number (e.g., 54321), destination port number (e.g., 80), protocol type (e.g., TCP), packet payload length, TCP flags (e.g., SYN, ACK, FIN), and timestamp. These protocol interaction features collectively characterize the basic attributes of a network communication event.

[0075] In practical implementation, establishing a mapping relationship between protocol interaction characteristics and system call sequences is the core step in protocol behavior collaborative analysis. Establishing this mapping relationship relies on shared context information such as time correlation and process identifiers. For example, when a monitoring agent captures a `recvfrom` system call, which instructs a specific process (PID 1234) to read data from a network socket, simultaneously, the network monitoring component records a data packet sent from IP address 192.168.1.10:54321 to 10.0.0.5:80 at a similar time point (considering the minor delays in system call processing and network transmission / reception). By comparing the proximity of the timestamps and the association between the socket descriptor and the network 5-tuple, this `recvfrom` system call can be precisely associated with the corresponding network data packet reception event. By systematically establishing all such associations, a protocol behavior association matrix can be constructed. The protocol behavior association matrix is ​​a two-dimensional matrix. Its row index can represent different protocol sessions, and its column index can represent different system call types. The value of the element ProtocolBehaviorMatrix[i][j] in the matrix can represent the frequency of the j-th type of system call in the i-th protocol session, or the total amount of data involved in this type of system call in the session.

[0076] In practical implementation, a graph structure algorithm is used to perform topological analysis on the protocol behavior correlation matrix to generate a protocol interaction graph. Specifically, the protocol behavior correlation matrix is ​​transformed into a directed weighted graph structure. In this directed weighted graph structure, each node represents a protocol interaction entity, which can be a process participating in communication, an IP address, or a combination of (IP address, port). Each directed edge represents a protocol interaction relationship from one entity to another, such as an HTTP request from a client process to a web server process. The weights of the directed edges are assigned based on the protocol interaction frequency and data volume. A specific weight assignment method can be standardized using the following formula:

[0077]

[0078] in: This represents the final weight of the edge from node a to node b; This represents the number of interactions from a to b within the observation period; This represents the maximum interaction frequency among all edges in the graph; This represents the total amount of data transmitted from a to b during the observation period; This represents the maximum amount of data among all edges in the graph; and They are weighting coefficients and satisfy... This is used to adjust the relative importance of frequency and data volume in weight calculation.

[0079] In practical implementation, a community detection algorithm is applied to partition the constructed directed weighted graph into communities. This algorithm identifies densely connected clusters of nodes by optimizing the modularity index. It groups closely interacting nodes into the same community, while connections between communities are relatively sparse. Calculating the centrality index of each node is a crucial step in evaluating node importance. Degree centrality measures the number of directly connected neighbors a node has; betweenness centrality measures the number of times a node lies on the shortest path between other node pairs in the graph, reflecting its control as a "bridge"; proximity centrality measures the reciprocal of the average distance from a node to all other nodes in the graph, reflecting the efficiency of information reaching that node. Based on the community partitioning results and node centrality calculation results, a topological feature descriptor for the protocol interaction graph is generated. This topological feature descriptor is a multi-dimensional vector that can contain statistical features such as the number of communities, average community size, maximum community size, average degree of the graph, diameter of the graph, and the average degree centrality of the top k nodes. Finally, the topological feature descriptors are normalized, for example, using Min-Max scaling or Z-score normalization, to transform the feature values ​​of each dimension to a uniform scale, forming a standardized protocol interaction graph. This standardized protocol interaction graph provides structured input for subsequent multi-level security threat assessments.

[0080] In some embodiments, the generation of the protocol interaction graph can be periodic, such as generating a graph snapshot every minute based on aggregated data from the past minute, thus forming a time series of the graph to capture the dynamic evolution of interaction patterns. In some embodiments, the generation of the protocol interaction graph can also be triggered by a specific event, such as immediately generating a graph when a significant spike in system call rate or network traffic is detected. Optionally, when constructing a directed weighted graph, a weight threshold can be set to retain only edges with weights higher than the threshold, filtering out accidental and unimportant interactions, simplifying the graph structure, and reducing computational complexity. Optionally, the protocol interaction graph can be stored using a graph database to efficiently perform complex graph traversal and query operations. It can be understood that the protocol interaction graph transforms abstract network traffic and system call data into an intuitive topology structure, enabling administrators to visually understand the complex internal and external interaction relationships of servers, providing a foundation for graph theory-based anomaly detection algorithms.

[0081] Example 3: See Figure 3In practical implementation, community discovery processing of the protocol interaction graph is the first step. This process uses graph clustering algorithms to aggregate closely connected nodes in the protocol interaction graph into multiple protocol interaction communities. For example, in a protocol interaction graph depicting web server interactions, the community discovery algorithm might identify a cluster of nodes including Apache processes, related library files, and MySQL database connections as a protocol interaction community, which collectively supports the operation of the web application. Simultaneously, it might identify another cluster of nodes including an SSH daemon and its active sessions as another protocol interaction community. After dividing the protocol interaction communities, the internal connection density of each community needs to be calculated. Internal connection density is defined as the ratio of the actual number of edges within the community to the theoretically maximum number of edges. A higher internal connection density indicates more frequent and closer interactions between nodes within the community. Simultaneously, the cross-community connection strength of each protocol interaction community needs to be calculated. Cross-community connection strength can be measured by calculating the sum of the weights of all edges pointing from a node in that community to nodes in other communities. Cross-community connection strength reflects the degree of interaction between that community and its external environment.

[0082] In practice, establishing a baseline model based on historical normal interaction patterns involves data collection and model training. Collecting protocol interaction data during normal operation means acquiring continuous protocol interaction graph sequences generated by the server within known periods of stable load and no known attacks. Feature parameters for each protocol interaction community are extracted from these historical graphs. These parameters primarily include community size (i.e., the number of nodes within the community), internal connection density, and cross-community connection strength between the community and every other major community. Statistical learning methods are used to fit the distribution of the collected historical feature parameters to establish a baseline probability model; for example, a multivariate Gaussian distribution can be used to model the set of feature parameters. The baseline probability model can describe the expected range of feature parameters and the covariance relationship between them under normal conditions. Furthermore, by analyzing the time series patterns of historical data, the baseline probability model can capture the changing patterns of feature parameters over time, such as distinguishing between different baselines on weekdays and weekends, or normal fluctuation patterns at different times of the day.

[0083] In practice, comparing the current protocol interaction community features with the baseline model is achieved by calculating the statistical distance. Feature parameters of each protocol interaction community are extracted from the real-time generated current protocol interaction graph to form the current feature vector X, which contains the same feature dimensions as historical data. The Mahalanobis distance between the current feature vector X and the baseline probability model is calculated using the following formula:

[0084]

[0085] in: This represents the Mahalanobis distance between the current feature vector X and the baseline model; vector This represents a feature vector extracted from the current protocol interaction graph; vector The mean vector representing the baseline probability model, i.e., the average value of historical normal feature parameters; matrix The covariance matrix representing the baseline probability model describes the correlation between various dimensions of historical normal characteristic parameters; (symbol) Represents the matrix transpose operation; symbol Let represent the inverse of the covariance matrix Σ. Mahalanobis distance considers the correlation between feature parameters. Unlike Euclidean distance, Mahalanobis distance more accurately reflects the position of the current state relative to the normal distribution in the multivariate feature space. The calculated Mahalanobis distance... The comparison is performed against a pre-set confidence interval, which is a threshold set based on the percentiles of the historical Mahalanobis distance distribution. When the Mahalanobis distance... When the threshold corresponding to the preset information interval is exceeded, it is determined that the characteristics of the current protocol interaction community are significantly different from the baseline model, and the protocol interaction community is marked as having an abnormal interaction mode.

[0086] In some embodiments, the identification of anomalous interaction patterns relies not only on the overall deviation of the Mahalanobis distance but also on anomalous fluctuations in specific features. For example, when the internal connection density of a protocol interaction community experiences a sharp decrease or a rapid increase within a short period, it may be flagged as anomaly due to the significant change in this single feature, even if the overall Mahalanobis distance may not exceed a threshold. In some embodiments, anomalies in cross-community connection strength are also important detection indicators. For instance, if an application server community that typically communicates only with its internal database community suddenly establishes a high-strength connection with an unknown external IP address community, this anomalous pattern of cross-community connection strength will also be identified. Optionally, the baseline probability model can be dynamically updated using a sliding window mechanism, incorporating data from the most recent historical period to retrain the model, allowing the baseline model to adapt to the slow drift of normal server behavior patterns. Optionally, independent baseline probability models can be established for different protocol interaction communities, as the normal behavior characteristics of different communities themselves vary significantly, and modeling them separately can improve the accuracy of anomaly detection.

[0087] See Figure 4This chart showcases the results of community discovery and security status analysis based on protocol interaction graphs. The chart visually presents the distribution of security characteristics among different protocol interaction communities using a scatter plot. The horizontal axis represents the internal connection density of a community, reflecting the tightness of interaction between nodes within the community; the vertical axis represents the cross-community connection strength, reflecting the degree of interaction between the community and its external environment. The size of each scatter point corresponds to the community size, i.e., the number of nodes within the community. Blue scatter points represent protocol interaction communities in a normal state, where both internal connection density and cross-community connection strength are within reasonable ranges, conforming to the expected behavior patterns of the historical baseline model. Red scatter points identify communities detected as abnormal, exhibiting significant deviations from the normal baseline in internal connection patterns or external interaction behavior. The green dashed ellipse represents the confidence interval of the baseline model built based on historical normal data, defining the acceptable range of characteristic parameters for normal communities. Communities falling outside the ellipse are considered to pose potential security threats and require further investigation and analysis. This visualization method allows security analysts to quickly identify protocol interaction communities with abnormal behavior in the system, providing crucial information for subsequent risk localization and protection strategy development.

[0088] Example 4: In specific implementation, extracting all protocol interaction entities involved in the abnormal interaction pattern is the starting point for risk area localization. Protocol interaction entities are nodes marked as abnormal in the protocol interaction graph. These nodes may include process instances, IP addresses, network port numbers, or combinations thereof exhibiting suspicious communication behavior. For example, if an abnormal interaction pattern manifests as an application process that normally handles internal requests suddenly establishing multiple connections with an uncommon port (65432) on an external IP address (203.0.113.5), then the application process, the external IP address 203.0.113.5, and port 65432 will all be extracted, collectively generating a risk entity set. The risk entity set contains the identifiers of all entities directly involved in the abnormal behavior.

[0089] In practical implementation, analyzing the spatiotemporal correlations between sets of risky entities to construct risk propagation paths is a crucial step. Spatiotemporal correlation analysis includes examining the time-series patterns of interactions between risky entities, the topological paths of network connections, and parent-child or communication relationships between processes. For example, by analyzing system call sequences and network flow logs, a risk propagation path may be discovered: a web server worker process injected with malicious code through an exploit first establishes a connection with a database slave server (IP10.0.1.20) on the internal network and attempts to extract sensitive data. Subsequently, the web server worker process encrypts the data and sends it to an external command and control server through an outbound connection. The entities on this link and the connections between them constitute a risk propagation path. Constructing a risk propagation path essentially involves linking discrete risky entities together according to temporal order and logical causal relationships to form hypotheses about potential attack chains.

[0090] In practice, a risk assessment algorithm calculates the threat level score for each constructed risk propagation path. The algorithm first analyzes the components of the risk propagation path, including path length, the types of nodes traversed, and the protocol categories used for interactions between nodes. Assigning risk weight coefficients to each component is a crucial part of the algorithm. The weight of a node type is determined based on its centrality index calculated in the protocol interaction graph. For example, the risk of compromising a database server node with high betweenness centrality is far greater than that of a peripheral user process node. The weight of the interaction protocol category is set based on the protocol's inherent security attributes. For instance, Telnet, using plaintext transmission, has a higher inherent risk weight than SSH, which uses encryption. Unknown or custom protocols may be assigned the highest risk weight to warn of potential threats. See Table 1 for an example of risk weight coefficient settings.

[0091] Table 1: Weighting Coefficients of Components in Risk Transmission Path

[0092]

[0093] A weighted summation algorithm is used to calculate the initial threat score for the risk propagation path. The formula involves multiplying the risk assignment of each element in the path by its corresponding weight coefficient, and then summing all the products. A time decay factor is introduced to dynamically adjust the initial threat score. This factor ensures that recently occurring events contribute more to the overall threat score, while the contribution of earlier events decreases over time, reflecting the urgency and time-sensitive nature of security threats. A threat level scoring formula incorporating time decay can be expressed as:

[0094]

[0095] in: A standardized threat level score representing the final stage of a risk propagation path; This represents the total number of elements included in the risk transmission path; The risk assignment represents the k-th element, such as node type risk assignment or protocol risk assignment; This represents the risk weight coefficient corresponding to the k-th element; This represents the timestamp of the interaction event corresponding to the k-th element. Represents the current assessment time; It is the decay constant, which controls the rate of decay over time; the function This is the time decay factor; It is a normalization factor, usually the theoretically or observed maximum possible score value, used to map the final score to a standard range (such as 0-100). It is a scaling factor used to adjust the results to the final scoring scale.

[0096] In some embodiments, the construction of risk propagation paths may not be limited to a single linear path; branching or merging paths may also be considered to construct a more complex attack graph model and score the overall threat of the entire attack graph. In some embodiments, the risk assessment algorithm may also incorporate threat intelligence data as a weighting factor. For example, if the external IP addresses involved in the path are known to belong to a list of command and control server IPs used by a certain malware family, the threat level score of that path will receive an additional multiplier. Optionally, the weighting coefficient table may not be static but dynamically loaded and adjusted according to different business stages of the server or different security policy requirements. Optionally, for very long risk propagation paths, a path length penalty factor may be introduced to avoid inflated cumulative scores due to excessively long paths, thus focusing more on the critical links of the attack chain. It can be understood that by quantitatively assessing the threat level of risk propagation paths, this implementation can accurately locate the most destructive core risk areas from multiple potential anomaly patterns, allowing limited security resources to be prioritized where they are most needed.

[0097] See Figure 5This chart demonstrates risk propagation paths and their threat level assessments based on abnormal interaction pattern recognition results. The chart uses horizontal bar graphs to clearly present the threat level scores of different risk propagation paths, allowing security managers to quickly grasp the severity of various security threats present in the system. Each bar represents an independent risk propagation path, and the length of the bar corresponds to the threat level score of that path; a higher score indicates a more severe potential security threat. Bar colors are categorized into four levels based on threat level: green for low risk, yellow for medium risk, orange for high risk, and red for severe risk. This color coding method makes threat level identification more intuitive. The red dashed line in the chart marks the high-risk threshold; risk propagation paths with scores exceeding this threshold require priority handling. The specific score values ​​marked on each bar provide a precise reference for quantitative assessment. Through this chart, security teams can systematically understand the threat level of various attack paths currently existing in the system, thereby rationally allocating security protection resources, prioritizing the most destructive core risk areas, and achieving efficient and accurate security protection.

[0098] Example 5: In practical implementation, obtaining real-time operating parameters of the core risk area is a prerequisite for accurate policy adaptation. These parameters are obtained by querying the server operating system's performance counters and network stack status information. Resource utilization parameters include quantitative indicators such as the CPU usage percentage, physical memory usage, and disk I / O wait time of processes associated with the core risk area. Network connection status parameters include the number of active network connections currently associated with the core risk area, connection rate (new connections / second), inbound and outbound packet rates of network interfaces, and the presence of a large number of half-open connections (SYN_RECV state) or abnormal connection flag combinations. For example, for a web server process identified as a core risk area, its real-time operating parameters might show a CPU utilization of 95%, continuously increasing memory usage, and thousands of concurrent HTTP connection requests from a small number of IP addresses.

[0099] In practice, basic protection policies are matched from a pre-built policy library based on real-time operational parameters. The policy library is a database or collection of configuration files storing various protection policy templates, each designed for a typical threat scenario and resource status. The matching process is based on rule-based conditional queries. For example, if real-time operational parameters show that a core risk area faces high concurrent connections and CPU resource constraints, a basic protection policy template based on "connection limit" and "request rate limit" might be matched; if the parameters show a large amount of abnormal outbound traffic, a basic protection policy template based on "outbound traffic filtering" and "destination IP blocking" might be matched. Each basic protection policy template includes the action type and configurable placeholder parameters.

[0100] In practical implementation, the parameters of the matched basic protection policy are adjusted based on the characteristics of abnormal interaction patterns to generate an optimized protection policy. The characteristics of abnormal interaction patterns provide a specific behavioral fingerprint of the attack. For example, if the abnormal interaction pattern manifests as frequent short-lived connections from a specific IP segment (such as 192.168.10.0 / 24), then the specific parameters of the limiting rule in the basic "connection limit" policy will be adjusted to target connections with source IP addresses belonging to the 192.168.10.0 / 24 network segment, and the threshold for the number of new connections allowed per second will be set to a lower value (such as 10 connections / second). The parameter adjustment process can be described as a rule-based optimization function, the output of which is the specific policy parameter value. The optimized protection policy is then transformed into security policy instructions that the security execution component can directly understand and execute. These security policy instructions must conform to the syntax specifications of the target execution component.

[0101] In practical implementation, executing dynamic security policy instructions to complete server security protection involves instruction distribution and execution. The generated security policy instructions are distributed to the corresponding security execution components, which may include host firewalls, intrusion prevention system modules, web application firewall instances, or internal traffic management agents. The distribution process requires a secure management channel to reliably transmit the instructions to the target components and trigger their loading. The security execution components then implement specific protective actions on the target protocol interactions, such as traffic shaping operations. Traffic shaping operations can include rate limiting, connection quota management, packet dropping, or connection reset. Monitoring the protocol interaction behavior after traffic shaping is a crucial part of closed-loop protection, requiring the collection of feedback data. Feedback data includes whether restricted abnormal traffic has decreased, whether resource utilization in core risk areas has returned to normal levels, and whether protective actions have inadvertently affected normal business requests (e.g., by monitoring the response time or error rate of normal business). Based on the collected feedback data, the basic protection policy parameters in the policy library are updated to achieve policy self-optimization. For example, if feedback data shows that the currently set connection limit threshold is too strict, causing a small number of legitimate users to be blocked, the following formula can be used to adjust the rate limit parameters in the policy library. Perform relaxation adjustments:

[0102]

[0103] in: This represents the new parameter values ​​(such as the new rate limit threshold) that will be stored in the policy library after the update. This represents the parameter value currently stored in the strategy library; This represents the ideal threshold estimate observed from the feedback data, which effectively suppresses attacks without affecting normal business operations; It is a learning rate coefficient with a value between 0 and 1, used to control the magnitude of parameter updates and avoid drastic fluctuations in parameters due to single observation errors.

[0104] In some embodiments, the execution of dynamic security policy instructions can be phased. For example, instructions in observation mode can be executed first, and after confirming the effectiveness of the policy and a low false positive rate, they can be converted to instructions in execution mode. In some embodiments, for complex attack scenarios, combined dynamic security policy instructions may be generated, that is, multiple instructions targeting different dimensions are simultaneously distributed to different security execution components to work together. Optionally, the policy library can support version management, saving a new version each time parameters are updated, so that a quick rollback to the previous stable version can be achieved if policy adjustments have negative effects. Optionally, the collection and analysis of feedback data can be performed in near real-time, thereby making the policy parameter update cycle very short and achieving adaptive security protection.

[0105] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0106] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A server security protection method, characterized in that, The processing includes the following stages: Perform dynamic tracking of server running status and obtain the results of dynamic tracking of server running status; The protocol behavior collaborative analysis is performed on the dynamic tracking results of the server's operating status to generate a protocol interaction graph; Perform multi-level security threat assessment based on the protocol interaction graph and identify abnormal interaction patterns; Based on the aforementioned abnormal interaction patterns, risk areas are located, and core risk areas are identified. Real-time protection strategy adaptation is performed for the core risk areas to generate dynamic security policy instructions; The dynamic security policy instructions are executed to complete the server security protection process.

2. The server security protection method according to claim 1, characterized in that, Perform dynamic tracking of server running status and obtain the results of the dynamic tracking, specifically including: The system call sequence is collected in real time by a monitoring agent deployed on the server node to generate a raw behavioral data stream; The original behavioral data stream is divided into time windows, and behavioral segments based on sliding time windows are extracted. For each of the behavioral segments, feature quantization is performed, and the statistical feature vector of the behavioral segment is calculated; The statistical feature vectors of continuous time windows are combined to form the dynamic tracking results of server operating status.

3. The server security protection method according to claim 2, characterized in that, The dynamic tracking results of the server's operating status are used to perform collaborative analysis of protocol behavior to generate a protocol interaction graph, specifically including: Analyze the network protocol data packets in the dynamic tracking results of the server's running status and extract protocol interaction features; Establish a mapping relationship between protocol interaction characteristics and system call sequences, and construct a protocol behavior correlation matrix; The protocol behavior correlation matrix is ​​analyzed topologically using a graph structure algorithm to generate a protocol interaction graph containing nodes and edges. In the protocol interaction graph, nodes represent protocol interaction entities, and edges represent protocol interaction relationships. The topological analysis of the protocol behavior association matrix using a graph structure algorithm specifically includes: converting the protocol behavior association matrix into a directed weighted graph structure, where the nodes of the graph correspond to protocol interaction entities, the edges of the graph correspond to protocol interaction relationships, and the edge weights are assigned based on the protocol interaction frequency and data volume; applying a community detection algorithm to partition the directed weighted graph into communities, identifying tightly connected community structures; calculating the centrality indices of each node, including degree centrality, betweenness centrality, and proximity centrality, to assess the importance of the node in protocol interactions; generating a topological feature descriptor for the protocol interaction graph based on the community structure and node centrality indices; and normalizing the topological feature descriptor to form a standardized protocol interaction graph.

4. A server security protection method according to claim 3, characterized in that, Based on the aforementioned protocol interaction graph, a multi-level security threat assessment is performed to identify abnormal interaction patterns, specifically including: The protocol interaction graph is subjected to community discovery processing to divide the protocol interaction communities; Calculate the internal connection density and cross-community connection strength for each protocol interaction community; A baseline model is established based on historical normal interaction patterns, and the characteristics of the current protocol interaction community are compared with the baseline model. When abnormal fluctuations in internal connection density or cross-community connection strength are detected, it is marked as an abnormal interaction mode.

5. A server security protection method according to claim 4, characterized in that, Based on the aforementioned abnormal interaction pattern, risk areas are located, and core risk areas are identified, specifically including: Extract the protocol interaction entities involved in the abnormal interaction patterns to generate a risk entity set; Analyze the spatiotemporal correlations among the aforementioned risk entities to construct risk propagation paths; The threat level score for each risk propagation path is calculated using a risk assessment algorithm; The areas corresponding to risk propagation paths whose threat level scores exceed a predetermined threshold are selected as core risk areas.

6. A server security protection method according to claim 5, characterized in that, Real-time protection strategy adaptation is performed for the core risk areas, generating dynamic security policy instructions, specifically including: Obtain real-time operating parameters of the core risk areas, including resource utilization and network connection status; Based on the real-time operating parameters, a basic protection strategy is matched from the strategy library; Based on the characteristics of the abnormal interaction mode, the parameters of the basic protection strategy are adjusted to generate an optimized protection strategy; The optimized protection strategy is transformed into executable security policy instructions, forming dynamic security policy instructions.

7. A server security protection method according to claim 6, characterized in that, Executing the dynamic security policy instructions to complete server security protection processing specifically includes: Distribute the dynamic security policy instructions to the corresponding security execution components; Traffic shaping operations are performed on the target protocol interactions through a secure execution component; Monitor protocol interaction behavior after traffic shaping and collect feedback data; The basic protection strategy parameters in the strategy library are updated based on the feedback data.

8. A server security protection method according to claim 4, characterized in that, The process of establishing a baseline model based on historical normal interaction patterns and comparing the current protocol interaction community characteristics with the baseline model specifically includes: Collect protocol interaction data during normal operation in history, and extract characteristic parameters of the protocol interaction community, including community size, internal connection density and cross-community connection strength; Statistical learning methods are used to fit the distribution of historical feature parameters to establish a baseline probability model, which includes the normal range of feature parameters and the time variation pattern. The feature parameters of the protocol interaction community are extracted in real time from the current protocol interaction graph to form the current feature vector; Calculate the Mahalanobis distance between the current feature vector and the baseline probability model as a measure of anomaly bias; When the Mahalanobis distance exceeds the preset confidence interval, it is determined that the current protocol interaction community characteristics are significantly different from the baseline model and are marked as an abnormal interaction mode.

9. A server security protection method according to claim 5, characterized in that, The calculation of the threat level score for each risk propagation path using a risk assessment algorithm specifically includes: Analyze the components of the risk propagation path, including path length, types of nodes traversed, and types of interaction protocols. Risk weight coefficients are assigned to each component, where the node type weight is determined based on the node centrality index, and the interaction protocol category weight is determined based on the protocol security level. The initial threat score of the risk propagation path is calculated using a weighted summation algorithm. The formula is the sum of the products of the risk value of each element and its corresponding weight. A time decay factor is introduced to dynamically adjust the initial threat score, with the most recent interaction events having a higher risk contribution. The threat score is normalized based on real-time network environment parameters to generate a standardized threat level score.

10. A server security protection system, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the server security protection method according to any one of claims 1 to 9.

Images