Public data situation awareness recognition system based on cloud computing

Abstract

The invention relates to the technical field of public data security protection, and discloses a public data situation awareness recognition system based on cloud computing, which is characterized by comprising a cloud processing platform used for monitoring, analyzing and deciding operation state data of a public service website. The cloud processing platform comprises the following modules: an acquisition module used for acquiring multi-dimensional real-time operation data of a target website, the multi-dimensional real-time operation data comprising user access traffic time sequence data and associated user attribute data; and the trigger module is used for capturing a traffic sudden increase event according to the analysis of the user access traffic time sequence data, and correspondingly generating an abnormal trigger signal. According to the method, the user association graph is constructed and the graph neural network analysis is fused, so that the cooperative relationship between microscopic users can be insighted from the macroscopic flow anomaly, and the normal business peak and the organized malicious access can be distinguished.

Description

Technical Field

[0001] This invention relates to the field of public data security protection technology, specifically to a cloud computing-based public data situational awareness and identification system. Background Technology

[0002] In the information society, public service websites bear core functions such as government affairs processing, information inquiry, and online services, making their access stability and security crucial. With the widespread adoption of online services, these websites face increasingly complex traffic challenges, including normal business peaks caused by social activities and policy announcements, as well as frequent abnormal access attacks such as distributed denial-of-service attacks and malicious web crawlers. Traditional security protection systems often rely on static threshold alerts or rule filtering based on single-point behavior, making it difficult to accurately distinguish between these two different types of traffic surges.

[0003] To address the aforementioned issues, existing technical solutions primarily focus on monitoring macro-level traffic indicators and blocking individual abnormal IPs. They lack effective means to quickly identify and pinpoint organized groups of abnormal behavior from massive concurrent accesses, which can easily lead to improper handling of distributed attacks. Summary of the Invention

[0004] The purpose of this invention is to provide a cloud computing-based public data situational awareness and identification system to solve the above-mentioned technical problems: The objective of this invention can be achieved through the following technical solutions: A cloud-based public data situational awareness and identification system, characterized in that the system includes a cloud processing platform, which is used for monitoring, analyzing, and making decisions regarding the operational status data of public service websites. The cloud processing platform includes the following modules: The data acquisition module is used to collect multi-dimensional real-time operational data of the target website, including user access traffic time-series data and associated user attribute data. The triggering module is used to capture traffic surge events based on the analysis of user access traffic time-series data and generate corresponding abnormal trigger signals. The feature analysis module is used to respond to the abnormal trigger signal, extract user attribute data within the time window corresponding to the traffic surge event, and construct a user association graph, wherein the user association graph has users as nodes and the logical correlation degree of behavioral features between users as edges. The identification module is used to calculate the connectivity index of each node in the user association graph and filter key nodes whose connectivity exceeds the dynamic threshold; combined with the characteristics of the key node group and the topology of the association graph, the traffic surge event attributes are determined by a preset identification model, and the traffic surge event attributes include normal business peaks and collaborative abnormal access. The execution module generates verification strategies for key nodes and, based on the judgment results, generates control strategies that include instructions to initiate verification challenges to key nodes.

[0005] As a further technical solution, the triggering module includes a baseline construction unit and a triggering unit; the baseline construction unit is used to establish a dynamic normal mode baseline for the user access traffic time series data based on historical data; the triggering unit is used to compare the real-time inflow user access traffic time series data with the dynamic normal mode baseline, and when a traffic surge event is detected through comparison, an abnormal triggering signal is generated.

[0006] As a further technical solution, the process of constructing the dynamic normal mode baseline includes: Collect user access traffic time-series data within a preset historical period, and divide it into daily time periods, holiday time periods, and peak time period subsets according to the time dimension; Each subset of data is decomposed into trend, periodic and random terms using a time-series decomposition algorithm. The trend term is used to fit the long-term variation pattern, and the periodic term is used to extract multi-scale periodic features such as intraday, intraweek, and intramonth. By combining the trend and periodic characteristics of each subset of data, an initial normal pattern baseline is constructed using a sliding window adaptive algorithm; The latest normal traffic time-series data is introduced in real time, and the baseline parameters are dynamically updated using the exponential moving average method, so that the baseline can be adaptively adjusted according to changes in business scenarios, while setting the baseline fluctuation threshold range.

[0007] Further technical solutions and the process of constructing a user relationship graph include: Based on the captured user attribute data, multi-dimensional correlation features between users are extracted. These correlation features include: IP address range belonging to the same category, user agent string similarity, access time series synchronization, requested resource set overlap, and access path sequence edit distance. Differentiated weights are assigned to each associated feature; the association strength between user pairs is calculated by weighted summation, and the association strength is used as the edge weight to construct a user association graph with edge weights.

[0008] As a further technical solution, the connectivity index can be optionally set to weighted degree centrality or betweenness centrality; The weighted degree centrality is calculated by the sum of the weights of all associated edges of a node; Betweenness centrality is calculated by the probability that a node lies on the shortest path between all other nodes; The dynamic threshold The calculation method is as follows ;in, The global average connectivity of the user association graph; The standard deviation of connectivity; The preset adjustment coefficient, This is the real-time traffic scale coefficient, specifically the ratio of real-time traffic to historical average traffic.

[0009] As a further technical solution, the preset recognition model is a graph neural network model, and the recognition process of the graph neural network model includes: The normalized vectors of user attribute data, edge weights, and the overall topology of the user association graph are used as inputs. The graph convolutional layer extracts local neighborhood features of nodes, and the graph pooling layer aggregates global features. The output layer uses the softmax activation function to output the classification probability of traffic surge event attributes. The classification probability includes the probability of normal business peak and the probability of collaborative abnormal access.

[0010] As a further technical solution, the verification strategy includes: Based on the degree of deviation between the connectivity index of the key nodes and the corresponding dynamic threshold, the key nodes are divided into different risk levels. For key nodes with different risk levels, match CAPTCHA types with different complexity and interaction strength; among them, the higher the risk level, the higher the computational complexity of the matched CAPTCHA and the higher the user interaction cost. During the matching process, a real-time system load factor is introduced as a constraint: when the real-time system load exceeds a preset threshold, the CAPTCHA type with medium to low risk level is downgraded. Add critical nodes that fail verification to a temporary blacklist.

[0011] As a further technical solution, the generation process of the control strategy includes: If the access is determined to be a collaborative abnormal access, a first-level control policy is generated. The first-level control policy includes: recording the access behavior trajectory of key nodes; and limiting the request frequency of key nodes within a unit of time to a preset range. If it is determined to be a normal business peak, a second-level control policy is generated. The second-level control policy includes: recording the access behavior trajectory of key nodes and not imposing request frequency restrictions on key nodes. The verification challenge command is sent to the application gateway of the target website through an encrypted channel, and the application gateway performs differentiated control on subsequent access requests to key nodes.

[0012] The beneficial effects of this invention are: This invention, by constructing a user relationship graph and integrating graph neural network analysis, can reveal the collaborative relationships between micro-level users from macro-level traffic anomalies, thereby distinguishing between normal business peaks and organized malicious access. The system can automatically identify core organizational nodes within abnormal groups and generate corresponding differentiated verification and control strategies. Therefore, it improves the accuracy and response efficiency in identifying collaborative attacks, avoiding the interference to the normal user experience caused by misjudgments or inadequate handling in traditional solutions. It achieves a balance between security protection and service quality while ensuring the security and stability of public service websites. Attached Figure Description

[0013] The invention will now be further described with reference to the accompanying drawings.

[0014] Figure 1 This is a framework diagram of a cloud computing-based public data situational awareness and identification system according to the present invention. Detailed Implementation

[0015] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0016] Please see Figure 1 As shown, a cloud-based public data situational awareness and identification system is characterized in that the system includes a cloud processing platform, which is used for monitoring, analyzing, and making decisions regarding the operational status data of public service websites. The cloud processing platform includes the following modules: The data acquisition module is used to collect multi-dimensional real-time operational data of the target website. This multi-dimensional real-time operational data includes user access traffic time-series data and associated user attribute data. Specifically, the user access traffic time-series data consists of sequence data sorted by timestamp, including the number of user requests, request packet size, and request response duration. The associated user attribute data includes the user's terminal IP address, user agent string, accessed resource URL, and access timestamp.

[0017] The triggering module is used to capture traffic surge events based on the analysis of user access traffic time-series data and generate corresponding abnormal trigger signals.

[0018] The feature analysis module is used to respond to the abnormal trigger signal, extract user attribute data within the time window corresponding to the traffic surge event, and construct a user association graph, wherein the user association graph has users as nodes and the logical correlation degree of behavioral features between users as edges. The identification module is used to calculate the connectivity index of each node in the user association graph and filter key nodes whose connectivity exceeds the dynamic threshold; combined with the characteristics of the key node group and the topology of the association graph, the traffic surge event attributes are determined by a preset identification model, and the traffic surge event attributes include normal business peaks and collaborative abnormal access. The execution module generates verification strategies for key nodes and, based on the judgment results, generates control strategies that include instructions to initiate verification challenges to key nodes.

[0019] The above embodiments provide a cloud-based public data situational awareness and identification system. Its core integrates multiple functional modules through a cloud processing platform, enabling real-time collection of multi-dimensional operational data from public service websites and intelligent identification and handling of traffic surges throughout the entire process. By constructing user relationship graphs to uncover key nodes and combining preset models to distinguish between normal business peaks and collaborative abnormal access, the system generates layered verification and hierarchical control strategies. Leveraging a cloud computing architecture, the system improves data processing and decision-making efficiency, accurately identifies abnormal access behavior to ensure the operational security of public service websites, and avoids over-control during normal business peaks, balancing system security and service continuity, thus achieving intelligent and precise public data situational awareness.

[0020] The triggering module includes a baseline construction unit and a triggering unit. The baseline construction unit is used to establish a dynamic normal mode baseline for the user access traffic time-series data based on historical data. The triggering unit is used to compare the real-time inflow user access traffic time-series data with the dynamic normal mode baseline. When a traffic surge event is detected through comparison, an abnormal trigger signal is generated. The above embodiment provides the constituent units of the triggering module. The construction unit builds a dynamic baseline, and then the triggering unit compares the real-time inflow user access traffic time-series data with the dynamic normal mode baseline time-stamp by time to detect traffic surge events. It should be noted that the core value of the system is not to continuously process all massive amounts of data, but to make accurate judgments at critical moments. A traffic surge is the most macroscopic and observable signal of a qualitative change in the operating status of a public service website. It indicates that the system may be facing the initial impact of a real business peak or a malicious attack. Although cloud computing resources are highly elastic, unlimited, full-dimensional, deep correlation analysis of all user behaviors is not feasible in terms of cost and real-time performance. Therefore, detecting traffic surge events is a necessary prerequisite for the system to proactively detect traffic surge events.

[0021] The process of constructing the dynamic normal mode baseline includes: Collect time-series user access traffic data within a preset historical period, typically no less than 90 days, to cover different time scenarios such as weekdays, weekends, and public holidays. Divide the data into daily time periods, holiday time periods, and peak time periods, with the division rules for each time period pre-defined based on the business characteristics of the target website.

[0022] Each subset of data is decomposed into trend, periodic and random terms using a time series decomposition algorithm. The existing STL decomposition algorithm can be used for the time series decomposition algorithm. The long-term change pattern is fitted based on the trend term. The long-term change pattern of the flow is fitted based on the trend term using linear regression or polynomial fitting method. The multi-scale periodic features of daily, weekly and monthly periods are extracted based on the periodic term.

[0023] Then, combining the trend and periodic characteristics of each subset, an initial normal pattern baseline is constructed using a sliding window adaptive algorithm. The window length of the sliding window is dynamically adjusted according to the periodic characteristics of the subset, and the window step size is the duration corresponding to a single collection timestamp.

[0024] The latest normal traffic time-series data is introduced in real time, and the baseline parameters are dynamically updated using the exponential moving average method, so that the baseline can be adaptively adjusted according to changes in business scenarios. At the same time, a baseline fluctuation threshold range is set. For example, the upper limit of the threshold range is 150%-200% of the baseline value, and the lower limit is 50%-80% of the baseline value. The specific values ​​are determined based on the historical traffic fluctuation range of the target website.

[0025] The process of constructing a user relationship graph includes: Based on the extracted user attribute data, multi-dimensional correlation features between users are extracted, and these correlation features specifically include: IP address range ownership: Determines whether the IP addresses of two users belong to the same network segment. If they do, assign a value of 1; otherwise, assign a value of 0. User agent string similarity: The cosine similarity algorithm is used to calculate the similarity between the user agent strings of two users, with the value range being [0,1]. Access time series synchronization: The correlation between the access timestamp sequences of two users is calculated using the Pearson correlation coefficient, with a value range of [-1, 1]. Request resource set overlap: Calculates the ratio of the number of elements in the intersection of two user request resource URL sets to the number of elements in the union, with a value range of [0,1]. Access path sequence edit distance: Calculate the edit distance between the access path sequences (URL sequences arranged in access order) of two users and normalize them. The value range is [0,1]. Differentiated weights are assigned to each associated feature, and the weight values ​​are determined by the Analytic Hierarchy Process (AHP). The sum of the weights of each feature is 1. The association strength between user pairs is calculated by weighted summation, and the association strength is used as the edge weight to construct a user association graph with edge weights.

[0026] The specific formula for calculating the correlation strength is as follows: Calculate the relationship between user i and user j (denoted as: user pair) The correlation strength between ) and , where The weight of the k-th associated feature. For users The value of the kth associated feature.

[0027] The connectivity index can be optionally set to weighted degree centrality or betweenness centrality; The weighted degree centrality is calculated by summing the weights of all associated edges of a node, reflecting the node's direct influence in the association graph. Specifically, weighted degree centrality... ,in This represents the total number of nodes in the user association graph. For nodes With nodes Edge weights between them.

[0028] Betweenness centrality is calculated by probing the probability that a node lies on the shortest path between all other nodes, reflecting the node's role as a hub for information transmission in the graph. Specifically, betweenness centrality... ,in For nodes To the node The total number of shortest paths, For nodes To the node Passing through the node The number of shortest paths.

[0029] The dynamic threshold The calculation method is as follows ;in, The global average connectivity of the user association graph; The standard deviation of connectivity; The preset adjustment coefficient (range 1.2-2.0); This is the real-time traffic scale coefficient, specifically the ratio of real-time traffic to historical average traffic.

[0030] The preset recognition model is a graph neural network model, preferably a graph convolutional neural network (GCN) or a graph attention network (GAT). The recognition process of the graph neural network model includes: The normalized vectors of user attribute data, edge weights, and the overall topology of the user association graph are used as inputs. The graph convolutional layer extracts local neighborhood features of nodes, and the graph pooling layer aggregates global features. The output layer uses the softmax activation function to map the high-dimensional feature vector into a probability distribution and outputs the classification probability of the traffic surge event attribute. When the probability of collaborative abnormal access is greater than the preset probability threshold, the event attribute is determined to be collaborative abnormal access; otherwise, it is determined to be a normal business peak.

[0031] The verification strategy includes: Based on the deviation of the connectivity index of the key nodes from the corresponding dynamic threshold, the key nodes are classified into different risk levels. For example, based on the deviation of the connectivity index of the key nodes from the corresponding dynamic threshold, the key nodes are classified into three risk levels: high, medium, and low. Among them, a connectivity index greater than twice the dynamic threshold is a high-risk level, a connectivity index between one and two times the dynamic threshold is a medium-risk level, and a connectivity index between one and 1.5 times the dynamic threshold is a low-risk level. For key nodes with different risk levels, different CAPTCHA types with varying complexity and interaction intensity are matched; the higher the risk level, the higher the computational complexity of the matched CAPTCHA and the higher the user interaction cost. For example, high-risk levels are matched with sliding puzzle CAPTCHAs or point-and-click CAPTCHAs, medium-risk levels are matched with numeric CAPTCHAs or letter CAPTCHAs, and low-risk levels are matched with implicit CAPTCHAs that require no interaction.

[0032] During the matching process, a real-time system load factor is introduced as a constraint: when the real-time system load exceeds a preset threshold, CAPTCHA types of medium to low risk levels are downgraded. Specifically, the real-time system load factor is the weighted average of the cloud processing platform's CPU utilization, memory utilization, and network bandwidth utilization. When the real-time system load factor exceeds the preset threshold, CAPTCHA types of medium to low risk levels are downgraded; that is, medium-risk CAPTCHAs are downgraded to the CAPTCHA types corresponding to low-risk CAPTCHAs, while low-risk CAPTCHAs are skipped entirely. Finally, critical nodes that fail verification are added to a temporary blacklist, restricting access requests to those nodes for a specified period.

[0033] The process of generating control strategies includes: If the access is determined to be a cooperative anomaly, a first-level control policy is generated, which includes: Behavior tracking records the access behavior of key nodes in real time, including access IP, access time, requested resources, and request frequency, and stores it in a cloud database; request frequency limiting restricts the request frequency of key nodes within a preset range per unit time.

[0034] If it is determined to be a normal business peak, a second-level control policy will be generated. The second-level control policy includes: as above, recording the access behavior trajectory of key nodes, but not limiting the request frequency of key nodes.

[0035] Finally, the command is issued. The verification challenge command is sent to the application gateway of the target website through an SSL encrypted channel, and the application gateway performs differentiated control on subsequent access requests to key nodes.

[0036] The foregoing has provided a detailed description of one embodiment of the present invention, but this description is merely a preferred embodiment and should not be construed as limiting the scope of the invention. All equivalent variations and modifications made within the scope of the claims of this invention should still fall within the patent coverage of this invention.

Claims

1. A public data situational awareness and identification system based on cloud computing, characterized in that, The system includes a cloud processing platform, which is used for monitoring, analyzing, and making decisions regarding the operational status data of the public service website. The cloud processing platform includes the following modules: The data acquisition module is used to collect multi-dimensional real-time operational data of the target website, including user access traffic time-series data and associated user attribute data. The triggering module is used to capture traffic surge events based on the analysis of user access traffic time-series data and generate corresponding abnormal trigger signals. The feature analysis module is used to respond to the abnormal trigger signal, extract user attribute data within the time window corresponding to the traffic surge event, and construct a user association graph, wherein the user association graph has users as nodes and the logical correlation degree of behavioral features between users as edges. The identification module is used to calculate the connectivity index of each node in the user association graph and filter key nodes whose connectivity exceeds the dynamic threshold; combined with the characteristics of the key node group and the topology of the association graph, the traffic surge event attributes are determined by a preset identification model, and the traffic surge event attributes include normal business peaks and collaborative abnormal access. The execution module generates verification strategies for key nodes and, based on the judgment results, generates control strategies that include instructions to initiate verification challenges to key nodes.

2. The public data situational awareness and identification system based on cloud computing according to claim 1, characterized in that, The triggering module includes a baseline construction unit and a triggering unit; The baseline construction unit is used to establish a dynamic normal mode baseline for the user access traffic time series data based on historical data; The triggering unit is used to compare the real-time incoming user access traffic time-series data with the dynamic normal mode baseline, and generate an abnormal trigger signal when a traffic surge event is detected through comparison.

3. A public data situational awareness and identification system based on cloud computing according to claim 2, characterized in that, The process of constructing the dynamic normal mode baseline includes: Collect user access traffic time-series data within a preset historical period, and divide it into daily time periods, holiday time periods, and peak time period subsets according to the time dimension; Each subset of data is decomposed into trend, periodic and random terms using a time-series decomposition algorithm. The long-term variation pattern is fitted based on the trend term, and multi-scale periodic features are extracted based on the periodic term. By combining the trend and periodic characteristics of each subset of data, an initial normal pattern baseline is constructed using a sliding window adaptive algorithm; The latest normal traffic time-series data is introduced in real time, and the baseline parameters are dynamically updated using the exponential moving average method, so that the baseline can be adaptively adjusted according to changes in business scenarios, while setting the baseline fluctuation threshold range.

4. A public data situational awareness and identification system based on cloud computing according to claim 3, characterized in that, The process of constructing a user relationship graph includes: Based on the captured user attribute data, multi-dimensional correlation features between users are extracted. These correlation features include: IP address range belonging to the same category, user agent string similarity, access time series synchronization, requested resource set overlap, and access path sequence edit distance. Differentiated weights are assigned to each associated feature, and the association strength between user pairs is calculated by weighted summation. The association strength is used as the edge weight to construct a user association graph with edge weights.

5. A public data situational awareness and identification system based on cloud computing according to claim 4, characterized in that, The connectivity index can be optionally set to weighted degree centrality or betweenness centrality; The weighted degree centrality is calculated by the sum of the weights of all associated edges of a node; Betweenness centrality is calculated by the probability that a node lies on the shortest path between all other nodes; The dynamic threshold The calculation method is as follows ;in, The global average connectivity of the user association graph; The standard deviation of connectivity; The preset adjustment coefficient; This is the real-time traffic scale coefficient, specifically the ratio of real-time traffic to historical average traffic.

6. A public data situational awareness and identification system based on cloud computing according to claim 5, characterized in that, The preset recognition model is a graph neural network model, and the recognition process of the graph neural network model includes: The normalized vectors of user attribute data, edge weights, and the overall topology of the user association graph are used as inputs. The graph convolutional layer extracts local neighborhood features of nodes, and the graph pooling layer aggregates global features. The output layer uses the softmax activation function to output the classification probability of traffic surge event attributes. The classification probability includes the probability of normal business peak and the probability of collaborative abnormal access.

7. A public data situational awareness and identification system based on cloud computing according to claim 6, characterized in that, The verification strategy includes: Based on the degree of deviation between the connectivity index of the key nodes and the corresponding dynamic threshold, the key nodes are divided into different risk levels. For key nodes with different risk levels, match CAPTCHA types with different complexity and interaction strength; During the matching process, a real-time system load factor is introduced as a constraint: when the real-time system load exceeds a preset threshold, the CAPTCHA type with medium to low risk level is downgraded. Add critical nodes that fail verification to a temporary blacklist.

8. A public data situational awareness and identification system based on cloud computing according to claim 7, characterized in that, The process of generating the control strategy includes: If the access is determined to be a collaborative abnormal access, a first-level control policy is generated. The first-level control policy includes: recording the access behavior trajectory of key nodes; and limiting the request frequency of key nodes within a unit of time to a preset range. If it is determined to be a normal business peak, a second-level control policy is generated. The second-level control policy includes: recording the access behavior trajectory of key nodes and not imposing request frequency restrictions on key nodes. The verification challenge command is sent to the application gateway of the target website through an encrypted channel, and the application gateway performs differentiated control on subsequent access requests to key nodes.

Images