Cloud native application security monitoring and compliance auditing method based on big data analysis

Abstract

The invention discloses a cloud native application security monitoring and compliance auditing method based on big data analysis, and relates to the technical field of cloud native security. According to the cloud native application security monitoring and compliance auditing method based on big data analysis, by constructing a dynamic security baseline, normal service fluctuation and real abnormal behaviors are accurately distinguished, and the false report and missing report rate is effectively reduced; through a multi-modal feature fusion unit, barriers among heterogeneous data such as logs, configuration and network traffic are broken through, cross-data-source security event association analysis is realized, and the full view of an attack event is quickly restored; the compliance standard is dynamically associated with the resource configuration, so that the compliance state is continuously monitored, and the compliance risk caused by the configuration change is found in time; by establishing a mapping relation between abnormal events and compliance requirements, data linkage of safety monitoring and compliance auditing is realized, abstract safety alarms are converted into specific compliance influence evaluation, and finally a traceable real-time auditing report is generated.

Description

Technical Field

[0001] This invention relates to the field of cloud-native security technology, specifically to a method for security monitoring and compliance auditing of cloud-native applications based on big data analytics. Background Technology

[0002] With the rapid development of cloud computing technology, cloud-native architecture has become the mainstream choice for enterprise digital transformation. While containerized deployment, microservice architecture, and dynamic orchestration improve application delivery efficiency, they also introduce new security challenges. Existing cloud-native security monitoring technologies mainly focus on the following aspects: At the infrastructure level, runtime security tools monitor container behavior and detect abnormal process startups and file system tampering based on preset rules; at the network level, service meshes are used to implement traffic encryption and access control, and abnormal communication patterns are analyzed through traffic mirroring; at the image level, static scanning tools detect known vulnerabilities and generate vulnerability reports; at the compliance level, manual auditing or periodic scanning tools are used to check configuration compliance and output compliance check reports.

[0003] However, existing cloud-native security monitoring technologies suffer from poor dynamic adaptability, insufficient multi-source data correlation analysis capabilities, and lagging compliance audits. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides a cloud-native application security monitoring and compliance auditing method based on big data analytics, which solves the problems of poor dynamic adaptability, insufficient multi-source data correlation analysis capabilities, and lagging compliance auditing in existing cloud-native security monitoring technologies.

[0005] To achieve the above objectives, this invention provides the following technical solution: a cloud-native application security monitoring and compliance auditing method based on big data analytics, comprising a cloud-native data acquisition module, a security baseline generation module, an abnormal behavior detection module, a compliance knowledge graph construction module, a risk correlation analysis module, and an audit report generation module, wherein:

[0006] The cloud-native data acquisition module is used to collect and preprocess cloud-native environment datasets, which include infrastructure layer data, orchestration layer data, application layer data, and image layer data. The security baseline generation module is used to construct a dynamic security baseline for the cloud-native environment based on the preprocessed dataset, using time-series statistical analysis algorithms. This dynamic security baseline includes a container process whitelist, network connection mode characteristics, system call frequency distribution, resource usage fluctuation ranges, and a service call relationship graph. The abnormal behavior detection module is used to identify abnormal behaviors in the cloud-native environment based on the dynamic security baseline, using a multimodal anomaly detection algorithm, and to correct the confidence level of abnormal events, outputting the anomaly. The system includes: an event and its corrected confidence level; a compliance knowledge graph construction module, used to semantically map cloud-native security compliance standards with cloud-native resource configuration data to build a compliance knowledge graph containing compliance requirements, resource configurations, and security control items; a risk correlation analysis module, used to integrate abnormal events output by the abnormal behavior detection module with compliance requirements in the compliance knowledge graph, and to perform cross-modal risk correlation analysis through graph neural networks to identify compliance risks triggered by abnormal behavior and risk propagation paths, thereby obtaining risk correlation analysis results; and an audit report generation module, used to generate differentiated automated response strategies based on the risk correlation analysis results, and dynamically generate compliance audit reports that include risk visualization, compliance status assessment, and evidence chain tracing.

[0007] Furthermore, preprocessing includes data cleaning, format standardization, timestamp alignment, feature extraction, and data dimensionality reduction.

[0008] Furthermore, the security baseline generation module includes a time-series data modeling unit, a periodic pattern recognition unit, and a security threshold calculation unit. Specifically: the time-series data modeling unit uses a seasonal decomposition algorithm to decompose the time-series data output by the cloud-native data acquisition module into trend, periodic, and residual terms, constructing a statistical distribution model of the time-series data; the periodic pattern recognition unit identifies the periodic behavior patterns of cloud-native applications, using a dynamic time warping algorithm to match the similarity of behavior patterns across different time windows, distinguishing between normal periodic fluctuations and potential abnormal fluctuations; and the security threshold calculation unit uses an exponentially weighted moving average method to dynamically calculate the security threshold range for each monitoring indicator based on the statistical distribution output by the time-series data modeling unit and the periodic characteristics output by the periodic pattern recognition unit, adjusting the security threshold sensitivity according to real-time feedback data, and outputting a dynamic security baseline.

[0009] Furthermore, the abnormal behavior detection module includes a multimodal feature fusion unit, a graph structure anomaly detection unit, and a temporal anomaly scoring unit. Specifically: the multimodal feature fusion unit converts monitoring data into a unified feature representation, dynamically allocates weights for different modal features, and outputs a fused multimodal feature vector; the graph structure anomaly detection unit constructs a dynamic behavior graph based on service call relationships and container deployment topology, uses a graph neural network to learn graph structure features under normal behavior patterns, and identifies structural anomalies by calculating the difference between the current behavior graph and the reconstructed graph; the temporal anomaly scoring unit combines the multimodal feature vector and structural anomaly degree, uses a long short-term memory network to model temporal dependencies, and outputs the temporal anomaly probability and comprehensive anomaly score corresponding to each monitoring indicator.

[0010] Furthermore, the process of correcting the bias in the confidence level of anomaly events is as follows: Based on the multimodal feature vectors output by the multimodal feature fusion unit, an initial feature representation of the anomaly event is constructed; causal analysis is used to identify confounding factors that may lead to false alarms, including normal traffic surges during peak business periods, normal change operations by maintenance personnel, and periodic maintenance of infrastructure; a counterfactual reasoning mechanism is designed to virtually intervene in the confounding factors and simulate the probability of anomaly events after removing the confounding effects; combined with the time-series anomaly probability output by the time-series anomaly scoring unit, the anomaly confidence level after counterfactual correction is calculated; the counterfactual corrected confidence level of each anomaly event is output to form a preliminary debiased anomaly event list; the accuracy and recall of the debiased anomaly event list are calculated, and if the indicators do not reach the preset threshold, the intervention intensity of counterfactual reasoning is adjusted until the F1 score of anomaly detection reaches the optimal level, and finally, stable anomaly events and confidence levels are output.

[0011] Furthermore, the compliance knowledge graph construction module includes a compliance standard semantic parsing unit, a resource configuration semantic mapping unit, and a graph fusion construction unit. Specifically: the compliance standard semantic parsing unit performs natural language processing on structured or semi-structured compliance standard documents, extracting entities and relationships between compliance requirements to form a semantic representation of the compliance standard; the resource configuration semantic mapping unit parses cloud-native resource configuration data, extracting entity types and configuration item values, and mapping them to a unified semantic space; the graph fusion construction unit aligns the compliance semantic representation output by the compliance standard semantic parsing unit with the resource configuration semantic representation output by the resource configuration semantic mapping unit, linking entities and relationships, and using graph embedding technology to construct a compliance knowledge graph containing compliance requirement nodes, resource configuration nodes, security control nodes, and their associated relationships.

[0012] Furthermore, the process of constructing the compliance knowledge graph is as follows: Semantic similarity is calculated between the compliance requirement entities output by the compliance standard semantic parsing unit and the resource configuration entities output by the resource configuration semantic mapping unit to establish a preliminary mapping relationship; a graph attention network is used to iteratively optimize the preliminary mapping relationship, and the semantic information of adjacent nodes is aggregated through a message passing mechanism to obtain entity alignment results; based on the entity alignment results, three types of core relationships are constructed: the relationship between compliance requirements and the requirement to meet resource configuration, the relationship between resource configuration and the implementation of security controls, and the dependency or inclusion relationship between different compliance requirements; the constructed triples are stored in a graph database to form an initial compliance knowledge graph; a graph traversal algorithm is used to perform consistency verification on the initial graph, detecting and correcting relationship conflicts and redundant entities to ensure the logical integrity of the graph; combined with real-time configuration changes in the cloud-native environment, an incremental update mechanism is designed to periodically synchronize new resource configuration data and dynamically update the corresponding entities and relationships in the graph, ultimately outputting a dynamically evolving compliance knowledge graph.

[0013] Furthermore, the risk correlation analysis module includes an abnormal event graph mapping unit, a cross-modal risk propagation unit, and a risk quantification assessment unit. Specifically: the abnormal event graph mapping unit maps abnormal events output by the abnormal behavior detection module to corresponding entity nodes in the compliance knowledge graph, constructing an abnormal event subgraph; the cross-modal risk propagation unit performs risk propagation analysis in the compliance knowledge graph based on the abnormal event subgraph, using a relational graph convolutional network in a graph neural network to identify affected compliance requirements and the scope of risk impact; and the risk quantification assessment unit calculates the risk score for each affected compliance requirement by combining the confidence level of the abnormal event, the length of the risk propagation path, and the severity level weight of the compliance requirement, outputting the risk correlation analysis results, including a list of high-risk compliance items, a risk propagation path graph, and a risk score.

[0014] Furthermore, the risk quantification assessment unit calculates the risk score as follows: Based on the confidence level of the abnormal event and the attenuation factor of the risk propagation path, the initial impact value of the abnormal event on various compliance requirements is calculated; combined with the predefined severity level weights of compliance requirements in the compliance knowledge graph, the risk score is calculated; when multiple abnormal events simultaneously affect the same compliance requirement, the comprehensive risk value is calculated using a risk accumulation method; combined with the time attenuation factor, historically addressed risk events are downweighted, and the calculated risk score is compared with a preset threshold to classify risk levels, including urgent, high-risk, medium-risk, and low-risk; if it is an urgent or high-risk risk, the real-time alarm mechanism of the audit report generation module is triggered; if it is a medium-risk or low-risk risk, it is collected in the periodic audit report for summary display.

[0015] Furthermore, the audit report generation module includes a differentiated strategy execution unit, an evidence chain tracing unit, and a dynamic report generation unit. Specifically: the differentiated strategy execution unit executes differentiated automated response strategies based on the risk level and risk type output by the risk correlation analysis module; the evidence chain tracing unit correlates the risk propagation path output by the risk correlation analysis module with the original data, extracting original logs, configuration change records, and network traffic packets within the time window before and after the occurrence of the abnormal event as evidence to form a traceable evidence chain; and the dynamic report generation unit integrates the response results of the differentiated strategy execution unit and the evidence data of the evidence chain tracing unit to dynamically generate a real-time compliance audit report that includes a risk overview, a compliance status heatmap, a visualization of the risk propagation path, an evidence chain list, and response and handling records, and supports exporting to multiple formats as needed.

[0016] The present invention has the following beneficial effects:

[0017] This cloud-native application security monitoring and compliance auditing method based on big data analytics constructs a dynamic security baseline that adapts to the dynamic changes in the cloud-native environment, accurately distinguishing between normal business fluctuations and real abnormal behavior, effectively reducing false positives and false negatives. Through a multimodal feature fusion unit, it breaks down barriers between heterogeneous data such as logs, configurations, and network traffic, enabling cross-data source security event correlation analysis and quickly reconstructing the full picture of attack events. By dynamically linking compliance standards with resource configurations, it achieves continuous monitoring of compliance status and timely detection of compliance risks arising from configuration changes. By establishing a mapping relationship between abnormal events and compliance requirements, it achieves data linkage between security monitoring and compliance auditing, transforming abstract security alerts into concrete compliance impact assessments, and ultimately generating traceable real-time audit reports, forming a unified closed loop for security monitoring and compliance auditing in the cloud-native environment.

[0018] Of course, any product implementing this invention does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0019] Figure 1 This is a flowchart of the cloud-native application security monitoring and compliance auditing method based on big data analysis according to the present invention. Detailed Implementation

[0020] Please see Figure 1 The present invention provides a technical solution: a cloud-native application security monitoring and compliance auditing method based on big data analysis, including a cloud-native data acquisition module for acquiring cloud-native environment datasets and performing preprocessing. The cloud-native environment datasets include infrastructure layer data, orchestration layer data, application layer data, and image layer data. The preprocessing includes data cleaning, format unification, timestamp alignment, feature extraction, and data dimensionality reduction.

[0021] The collected cloud-native environment dataset mainly includes four layers: infrastructure layer data, including container runtime logs, host system call records, network traffic metadata, etc.; orchestration layer data, including Kubernetes API audit logs, configuration files for various resources, Pod scheduling and state change events; application layer data, including call chain tracing data between microservices and log information output by business applications; and image layer data, including image build history information, software dependency lists, and vulnerability scan results. Preprocessing work mainly includes: cleaning noisy data, completing missing time information, unifying data of different formats into a standard format, accurately aligning timestamps for subsequent correlation analysis, extracting key features from the raw data, and performing dimensionality reduction on high-dimensional data to improve analysis efficiency.

[0022] The security baseline generation module is used to construct a dynamic security baseline for the cloud-native environment based on a preprocessed cloud-native environment dataset and using a time-series statistical analysis algorithm. The dynamic security baseline includes a container process whitelist, network connection mode characteristics, system call frequency distribution, resource usage fluctuation range, and service call relationship graph.

[0023] The security baseline generation module includes a time-series data modeling unit, a periodic pattern recognition unit, and a security threshold calculation unit, wherein:

[0024] The time-series data modeling unit is used to decompose time-series data output from the cloud-native data acquisition module into trend, periodic, and residual terms using a seasonal decomposition algorithm, thus constructing a statistical distribution model for the time-series data. For example, for indicators such as container CPU utilization, network connection count, and system call frequency, the seasonal decomposition algorithm is used to decompose the data into trend, periodic, and residual terms. The trend term reflects the long-term direction of change of the indicator, the periodic term reflects the daily or weekly recurring fluctuation pattern, and the residual term is the random fluctuation component after removing the trend and periodic terms.

[0025] The periodic pattern recognition unit identifies the periodic behavior patterns of cloud-native applications. It uses a dynamic time warping algorithm to match the similarity of behavior patterns across different time windows, distinguishing between normal periodic fluctuations and potential abnormal fluctuations. For example, e-commerce platforms experience higher traffic during the day and lower traffic at night on weekdays; resource usage in financial systems increases at the end of the month; and the early morning hours are typically a peak time for batch task execution. By comparing behavior patterns across different time windows using a time series matching algorithm, periodic patterns are identified, distinguishing normal periodic fluctuations from anomalies.

[0026] The security threshold calculation unit dynamically calculates the security threshold range for various monitoring indicators based on the statistical distribution output by the time-series data modeling unit and the periodic characteristics output by the periodic pattern recognition unit. It uses an exponentially weighted moving average method to adjust the security threshold sensitivity based on real-time feedback data, outputting a dynamic security baseline. Traditional fixed threshold methods are prone to failure in cloud-native environments because business loads are constantly changing. An adaptive algorithm is used to dynamically adjust the upper and lower limits of various indicators based on historical data. For example, system call frequency may be low in the early morning and high during the day; the dynamic threshold changes accordingly, using appropriate judgment criteria for appropriate time periods. If there are many false alarms within a certain period, the threshold range is appropriately widened; if there are many false negatives, the threshold range is appropriately tightened. The final output includes a container process whitelist (a list of allowed processes), network connection mode characteristics (normal IP and port connection modes), system call frequency distribution (normal frequency ranges for various types of system calls), resource usage fluctuation range (normal fluctuation ranges for resources such as CPU and memory), and a service call relationship graph (the topological structure of normal call relationships between services)—a dynamic security baseline.

[0027] The abnormal behavior detection module is used to identify abnormal behaviors in the cloud-native environment based on a dynamic security baseline and a multimodal anomaly detection algorithm, and to correct the confidence of abnormal events, outputting the abnormal events and their corrected confidence scores;

[0028] The abnormal behavior detection module includes a multimodal feature fusion unit, a graph structure anomaly detection unit, and a temporal anomaly scoring unit, wherein:

[0029] The multimodal feature fusion unit transforms monitoring data into a unified feature representation, dynamically assigns weights to different modal features, and outputs a fused multimodal feature vector. Log text, numerical metrics, and network traffic records are different types of data; feature extraction methods map them to the same feature space, and an attention mechanism automatically adjusts the weights of different data sources. The attention mechanism learns the importance of different features based on historical data: for example, for privilege escalation attacks, `execve` calls in system call logs and privileged operations in audit logs may be more important than network traffic, and the attention mechanism will assign them higher weights; for lateral movement attacks, network connection patterns and API call sequences may be more critical. The fused multimodal feature vector is output as input for subsequent anomaly detection.

[0030] The graph structure anomaly detection unit constructs a dynamic behavior graph based on service call relationships and container deployment topology. It employs a graph neural network to learn graph structure features under normal behavior patterns and identifies structural anomalies by calculating the difference between the current behavior graph and the reconstructed graph. In a cloud-native environment, service calls and containers communicate with each other, forming a dynamic behavior graph. A graph autoencoder is used to encode and decode the normal behavior graph, learning a low-dimensional embedding representation of the graph structure. During the detection phase, the current behavior graph is input into the model, and the reconstruction error is calculated; a larger difference indicates a more significant graph structure anomaly.

[0031] The temporal anomaly scoring unit combines multimodal feature vectors and graph structural anomaly scores, employing a Long Short-Term Memory (LSTM) network to model temporal dependencies and output the temporal anomaly probability and comprehensive anomaly score for each monitoring indicator. This unit uses a temporal model to analyze the changing patterns of behavior over time. Taking multimodal feature vectors and graph structural anomaly scores as input, it models the sequence features within a time window using an LSTM, outputting the temporal anomaly probability and comprehensive anomaly score for each monitoring indicator. For example, an indicator might only slightly exceed a threshold at a single point, but if it consistently exceeds the threshold and shows an upward trend across multiple time points, the LSTM will classify it as a more noteworthy high-scoring anomaly.

[0032] The process of bias correction for the confidence level of anomalous events is as follows:

[0033] Based on the multimodal feature vectors output by the multimodal feature fusion unit, an initial feature representation of the abnormal event is constructed.

[0034] Causal analysis can be used to identify confounding factors that may lead to false alarms, including normal traffic surges during peak business periods, normal change operations by operations and maintenance personnel, and periodic infrastructure maintenance.

[0035] Design a counterfactual reasoning mechanism to virtually intervene in confounding factors and simulate the probability of abnormal events after removing confounding effects;

[0036] Based on the time series anomaly probability output by the time series anomaly scoring unit, the anomaly confidence level after counterfactual correction is calculated.

[0037] Output the counterfactual corrected confidence level for each anomalous event to form a preliminary list of anomalous events that have been biased.

[0038] Calculate the accuracy and recall of the debiased list of anomalies. If the metrics do not reach the preset threshold, adjust the intervention intensity of counterfactual reasoning until the F1 score of anomaly detection reaches the optimal level. Finally, output stable anomalies and confidence levels.

[0039] We construct an initial feature representation of anomalous events and identify interfering factors that may lead to false alarms through causal analysis. Common interfering factors include: normal traffic surges during peak business periods, planned change operations by operations personnel, and periodic infrastructure maintenance.

[0040] A counterfactual reasoning mechanism is used to virtually intervene in these confounding factors. Specifically, the probability of anomalies after intervention is calculated using do-calculus. If network traffic still far exceeds normal levels after eliminating confounding factors, the credibility of the anomaly is high; conversely, if traffic returns to normal after elimination, the credibility should be reduced. Combining the temporal anomaly probability output by the temporal anomaly scoring unit, the anomaly confidence score after counterfactual correction is calculated (corrected confidence score = original anomaly probability - false anomaly probability contributed by confounding factors). For short-term surges in anomalies that conform to business cycle patterns (such as traffic peaks during promotional activities), their confidence scores are appropriately reduced; for long-term latent anomalies that exceed dynamic baselines (such as slow data theft or gradual permission probing), their confidence scores are appropriately increased.

[0041] Output the counterfactual corrected confidence score for each anomalous event to form a preliminary debiased list of anomalous events. Calculate the precision and recall of the debiased list of anomalous events. If the metrics do not reach the preset threshold, adjust the intervention intensity of the counterfactual reasoning (e.g., expand the scope of confounding factor identification, adjust the do-calculus parameters, add virtual intervention scenarios), and repeat the above correction process until the F1 score of anomaly detection reaches its optimal value. Finally, output stable anomalous events and their confidence scores.

[0042] The compliance knowledge graph construction module is used to semantically map cloud-native security compliance standards with cloud-native resource configuration data, and construct a compliance knowledge graph that includes compliance requirements, resource configuration, and security control items.

[0043] The compliance knowledge graph construction module includes a compliance standard semantic parsing unit, a resource configuration semantic mapping unit, and a graph fusion construction unit, among which:

[0044] The compliance standard semantic parsing unit is used to perform natural language processing on structured or semi-structured compliance standard documents, extracting entities and relationships between them to form a semantic representation of the compliance standard. Currently, mainstream cloud-native compliance standards include CIS Kubernetes Benchmark, NIST SP 800-190, GDPR, and the Cybersecurity Classified Protection Standard 2.0. These standards exist in document form and contain numerous compliance control items. Text parsing technology is used to extract information such as the number, description, inspection method, and expected results of each control item, and to identify dependencies and inclusion relationships between control items, forming a structured representation of the compliance standard.

[0045] The resource configuration semantic mapping unit is used to parse cloud-native resource configuration data, extract the entity types and configuration item values ​​of resource configurations, and map them to a unified semantic space. Cloud-native environment configurations typically exist in the form of YAML files, describing detailed configurations of resources such as Namespace, Pod, Service, NetworkPolicy, and ServiceAccount. This unit extracts the types and specific configuration values ​​of these resources and converts them into a unified representation.

[0046] The graph fusion construction unit is used to align the compliance semantic representation output by the compliance standard semantic parsing unit with the resource configuration semantic representation output by the resource configuration semantic mapping unit, and link their relationships. It uses graph embedding technology to construct a compliance knowledge graph containing compliance requirement nodes, resource configuration nodes, security control nodes and their related relationships.

[0047] The process of building a compliance knowledge graph is as follows:

[0048] The semantic similarity of the compliance requirement entity output by the compliance standard semantic parsing unit and the resource configuration entity output by the resource configuration semantic mapping unit is calculated to establish a preliminary mapping relationship.

[0049] A graph attention network is used to iteratively optimize the initial mapping relationship, and the semantic information of adjacent nodes is aggregated through a message passing mechanism to obtain the entity alignment result;

[0050] Based on the entity alignment results, three types of core relationships are constructed: the relationship between compliance requirements and the obligation to meet resource allocation, the relationship between resource allocation and the realization of security controls, and the dependency or inclusion relationship between different compliance requirements.

[0051] The constructed triples are stored in a graph database to form an initial compliance knowledge graph;

[0052] The initial graph is checked for consistency by using a graph traversal algorithm to detect and correct relationship conflicts and redundant entities, thus ensuring the logical integrity of the graph.

[0053] By combining real-time configuration changes in the cloud-native environment, an incremental update mechanism is designed to periodically synchronize new resource configuration data and dynamically update the corresponding entities and relationships in the graph, ultimately outputting a dynamically evolving compliance knowledge graph.

[0054] By employing semantic matching techniques (such as BERT-based text similarity calculation) and knowledge fusion techniques, compliance requirements and resource allocation are mapped onto the same knowledge graph. During construction, semantic similarity is first calculated between compliance requirement entities and resource allocation entities to establish an initial mapping relationship. Then, a Graph Attention Network (GAT) is used to iteratively optimize the initial mapping relationship, aggregating semantic information from adjacent nodes through a message passing mechanism. Ultimately, a compliance knowledge graph containing compliance requirement nodes, resource allocation nodes, security control nodes, and the relationships between them is formed.

[0055] The risk correlation analysis module is used to integrate the abnormal events output by the abnormal behavior detection module with the compliance requirements in the compliance knowledge graph. It uses graph neural networks to perform cross-modal risk correlation analysis, identify the compliance risks triggered by abnormal behavior and the risk propagation path, and obtain the risk correlation analysis results.

[0056] The risk correlation analysis module includes an anomaly event mapping unit, a cross-modal risk propagation unit, and a risk quantification assessment unit, among which:

[0057] The abnormal event graph mapping unit is used to map abnormal events output by the abnormal behavior detection module to the corresponding entity nodes in the compliance knowledge graph, and construct an abnormal event subgraph. For example, an abnormal event of "privileged container startup" will be mapped to the corresponding Pod entity and the configuration item "privileged: true" in the graph.

[0058] The cross-modal risk propagation unit is used to perform risk propagation analysis within the compliance knowledge graph based on anomaly event subgraphs. It employs a relational graph convolutional network within a graph neural network to identify affected compliance requirements and the scope of risk impact. Risk propagates from anomaly nodes along relational edges. For example, an anomaly event might first affect the configuration compliance status of a Pod, then influence related compliance requirements through "must meet" relationships, and further affect other compliance requirements through "dependency" relationships. Graph analysis methods are used to identify all affected compliance requirements and the specific paths of risk propagation.

[0059] The risk quantification assessment unit is used to calculate the risk score for each affected compliance requirement by combining the confidence level of the abnormal event, the length of the risk propagation path, and the severity level weight of the compliance requirement. It outputs risk correlation analysis results, including a list of high-risk compliance items, a risk propagation path diagram, and the risk score. The process of calculating the risk score by the risk quantification assessment unit is as follows:

[0060] Based on the confidence level of the abnormal event and the attenuation factor of the risk propagation path, the initial impact value of the abnormal event on various compliance requirements is calculated.

[0061] Calculate the risk score by combining the predefined severity levels of compliance requirements in the compliance knowledge graph;

[0062] When multiple abnormal events simultaneously affect the same compliance requirement, the comprehensive risk value is calculated using a risk accumulation method.

[0063] By combining the time decay factor, the risk events that have been dealt with in the past are downweighted, and the calculated risk scores are compared with preset thresholds to classify the risk levels, including emergency, high risk, medium risk and low risk.

[0064] If the risk is urgent or high-risk, the real-time alarm mechanism of the audit report generation module will be triggered; if the risk is medium or low-risk, it will be summarized and displayed in the periodic audit report.

[0065] The assessment process considers three main factors: the credibility of the anomaly, its propagation distance, and the severity level of the compliance requirement. The calculation formula is: Initial Impact Value = Credibility × Attenuation Coefficient^Propagation Distance; Weighted Risk Score = Initial Impact Value × Severity Level Weight. When multiple anomalies affect the same compliance requirement, a cumulative approach is used to calculate the overall risk. Based on the risk score, the results are categorized into four levels: Emergency, High-Risk, Medium-Risk, and Low-Risk.

[0066] The audit report generation module is used to generate differentiated automated response strategies based on the results of risk correlation analysis, and dynamically generate compliance audit reports that include risk visualization, compliance status assessment, and evidence chain tracing.

[0067] The audit report generation module includes a differentiated strategy execution unit, an evidence chain tracing unit, and a dynamic report generation unit, among which:

[0068] The differentiated strategy execution unit is used to execute differentiated automated response strategies based on the risk level and risk type output by the risk correlation analysis module. For critical risks with high risk scores, a blocking response is executed: the Kubernetes API is called to isolate the affected Pod, network policies are updated to block all traffic to it, and the node is marked as unschedulable if necessary. For high-risk risks, a remedial response is executed: a corrected configuration file is automatically generated and applied, the relevant containers are restarted to make the configuration effective, and network policies are updated to tighten permissions. For low- to medium-risk risks, only alarms and logs are recorded, and no automatic intervention is performed.

[0069] The evidence chain tracing unit is used to correlate the risk propagation path output by the risk correlation analysis module with the original data, extracting original logs, configuration change records, and network traffic packets within the time window before and after the occurrence of the abnormal event as evidence to form a traceable evidence chain. Based on the time point of the abnormal event and the entities involved (such as Pod name, Namespace, Container ID, and User account), relevant evidence is extracted from the storage of the cloud-native data collection module. The extracted evidence types include: original logs (original records of container runtime logs, Kubernetes audit logs, and application logs), configuration change records (comparison of differences in configuration files before and after the abnormal event), network traffic data (network connection records and key fields of traffic packets related to the entities involved), and image information (image layer information used by the container involved and vulnerability scan results). This evidence is organized chronologically to form a complete evidence chain including timestamps, event types, original data, and handling records, facilitating subsequent security investigations and compliance audits.

[0070] The dynamic report generation unit integrates the response results from the differentiated strategy execution unit and the evidence data from the evidence chain tracing unit to dynamically generate real-time compliance audit reports that include a risk overview, compliance status heatmap, risk propagation path visualization, evidence chain list, and response and handling records. It also supports exporting to multiple formats as needed. The report comprises several modules: the risk overview displays the current total number of risks, risk level distribution, and a list of high-risk compliance items; the compliance status heatmap displays compliance rates by namespace, compliance standards, and other dimensions; the risk propagation path visualization graphically shows the complete path of risk from abnormal events to compliance requirements; the evidence chain list lists original logs and configuration records in reverse chronological order; and the response and handling records display the operations and results automatically executed by the system. The report supports exporting to multiple formats to meet the needs of different use cases.

[0071] An electronic device includes: a processor; and a memory storing computer program instructions, which, when executed by the processor, cause the processor to perform the cloud-native application security monitoring and compliance auditing method based on big data analytics as described above.

[0072] A computer-readable storage medium for storing a program that, when executed by a processor, implements the cloud-native application security monitoring and compliance auditing method based on big data analytics as described above.

[0073] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0074] This invention is described with reference to flowchart illustrations and / or block diagrams of systems, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0075] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0076] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0077] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0078] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A cloud-native application security monitoring and compliance auditing method based on big data analytics, characterized in that, This includes a cloud-native data acquisition module, a security baseline generation module, an abnormal behavior detection module, a compliance knowledge graph construction module, a risk correlation analysis module, and an audit report generation module, among which: The cloud-native data acquisition module is used to collect and preprocess cloud-native environment datasets, which include infrastructure layer data, orchestration layer data, application layer data, and image layer data. The security baseline generation module is used to construct a dynamic security baseline for the cloud-native environment based on a preprocessed cloud-native environment dataset and using a time-series statistical analysis algorithm. The dynamic security baseline includes a container process whitelist, network connection mode characteristics, system call frequency distribution, resource usage fluctuation range, and service call relationship graph. The abnormal behavior detection module is used to identify abnormal behaviors in the cloud-native environment based on a dynamic security baseline and a multimodal anomaly detection algorithm, and to correct the confidence of abnormal events, outputting the abnormal events and the corrected confidence. The compliance knowledge graph construction module is used to semantically map cloud-native security compliance standards with cloud-native resource configuration data, and construct a compliance knowledge graph that includes compliance requirements, resource configuration, and security control items. The risk correlation analysis module is used to integrate the abnormal events output by the abnormal behavior detection module with the compliance requirements in the compliance knowledge graph. It uses graph neural networks to perform cross-modal risk correlation analysis, identify the compliance risks triggered by abnormal behavior and the risk propagation path, and obtain the risk correlation analysis results. The audit report generation module is used to generate differentiated automated response strategies based on the results of risk correlation analysis, and dynamically generate compliance audit reports that include risk visualization, compliance status assessment, and evidence chain tracing.

2. The cloud-native application security monitoring and compliance auditing method based on big data analytics as described in claim 1, characterized in that, Preprocessing includes data cleaning, format standardization, timestamp alignment, feature extraction, and data dimensionality reduction.

3. The cloud-native application security monitoring and compliance auditing method based on big data analytics as described in claim 1, characterized in that, The security baseline generation module includes a time-series data modeling unit, a periodic pattern recognition unit, and a security threshold calculation unit, wherein: The time series data modeling unit is used to decompose the time series data output by the cloud-native data acquisition module into trend, periodic and residual terms using a seasonal decomposition algorithm, and to build a statistical distribution model of the time series data. The periodic pattern recognition unit is used to identify the periodic behavior patterns of cloud-native applications. It uses a dynamic time warping algorithm to perform similarity matching on behavior patterns in different time windows, distinguishing between normal periodic fluctuations and potential abnormal fluctuations. The safety threshold calculation unit is used to dynamically calculate the safety threshold range of each monitoring indicator based on the statistical distribution output by the time series data modeling unit and the periodic characteristics output by the periodic pattern recognition unit. It also adjusts the safety threshold sensitivity according to real-time feedback data and outputs a dynamic safety baseline.

4. The cloud-native application security monitoring and compliance auditing method based on big data analytics as described in claim 1, characterized in that, The abnormal behavior detection module includes a multimodal feature fusion unit, a graph structure anomaly detection unit, and a temporal anomaly scoring unit, wherein: The multimodal feature fusion unit is used to convert monitoring data into a unified feature representation, dynamically allocate the weights of different modal features, and output the fused multimodal feature vector. The graph structure anomaly detection unit is used to construct a dynamic behavior graph based on service call relationships and container deployment topology. It uses a graph neural network to learn the graph structure features under normal behavior patterns and identifies structural anomalies by calculating the difference between the current behavior graph and the reconstructed graph. The temporal anomaly scoring unit combines multimodal feature vectors and structural anomaly degree, uses a long short-term memory network to model temporal dependencies, and outputs the temporal anomaly probability and comprehensive anomaly score for each monitoring indicator.

5. The cloud-native application security monitoring and compliance auditing method based on big data analytics as described in claim 1, characterized in that, The process of bias correction for the confidence level of anomalous events is as follows: Based on the multimodal feature vectors output by the multimodal feature fusion unit, an initial feature representation of the abnormal event is constructed. Causal analysis can be used to identify confounding factors that may lead to false alarms, including normal traffic surges during peak business periods, normal change operations by operations and maintenance personnel, and periodic infrastructure maintenance. Design a counterfactual reasoning mechanism to virtually intervene in confounding factors and simulate the probability of abnormal events after removing confounding effects; Based on the time series anomaly probability output by the time series anomaly scoring unit, the anomaly confidence level after counterfactual correction is calculated. Output the counterfactual corrected confidence level for each anomalous event to form a preliminary list of anomalous events that have been biased. Calculate the accuracy and recall of the debiased list of anomalies. If the metrics do not reach the preset threshold, adjust the intervention intensity of counterfactual reasoning until the F1 score of anomaly detection reaches the optimal level. Finally, output stable anomalies and confidence levels.

6. The cloud-native application security monitoring and compliance auditing method based on big data analytics as described in claim 1, characterized in that, The compliance knowledge graph construction module includes a compliance standard semantic parsing unit, a resource configuration semantic mapping unit, and a graph fusion construction unit, among which: The compliance standard semantic parsing unit is used to perform natural language processing on structured or semi-structured compliance standard documents, extract the entities and relationships between entities in compliance requirements, and form a semantic representation of the compliance standard. The resource configuration semantic mapping unit is used to parse cloud-native resource configuration data, extract the entity types and configuration item values ​​of resource configuration, and map them to a unified semantic space. The graph fusion construction unit is used to align the compliance semantic representation output by the compliance standard semantic parsing unit with the resource configuration semantic representation output by the resource configuration semantic mapping unit, and link their relationships. It uses graph embedding technology to construct a compliance knowledge graph containing compliance requirement nodes, resource configuration nodes, security control nodes and their related relationships.

7. The cloud-native application security monitoring and compliance auditing method based on big data analytics as described in claim 6, characterized in that, The process of building a compliance knowledge graph is as follows: The semantic similarity of the compliance requirement entity output by the compliance standard semantic parsing unit and the resource configuration entity output by the resource configuration semantic mapping unit is calculated to establish a preliminary mapping relationship. A graph attention network is used to iteratively optimize the initial mapping relationship, and the semantic information of adjacent nodes is aggregated through a message passing mechanism to obtain the entity alignment result; Based on the entity alignment results, three types of core relationships are constructed: the relationship between compliance requirements and the obligation to meet resource allocation, the relationship between resource allocation and the realization of security controls, and the dependency or inclusion relationship between different compliance requirements. The constructed triples are stored in a graph database to form an initial compliance knowledge graph; The initial graph is checked for consistency by using a graph traversal algorithm to detect and correct relationship conflicts and redundant entities, thus ensuring the logical integrity of the graph. By combining real-time configuration changes in the cloud-native environment, an incremental update mechanism is designed to periodically synchronize new resource configuration data and dynamically update the corresponding entities and relationships in the graph, ultimately outputting a dynamically evolving compliance knowledge graph.

8. The cloud-native application security monitoring and compliance auditing method based on big data analytics as described in claim 1, characterized in that, The risk correlation analysis module includes an anomaly event mapping unit, a cross-modal risk propagation unit, and a risk quantification assessment unit, among which: The abnormal event graph mapping unit is used to map the abnormal events output by the abnormal behavior detection module to the corresponding entity nodes in the compliance knowledge graph, and construct an abnormal event subgraph. The cross-modal risk propagation unit is used to perform risk propagation analysis in the compliance knowledge graph based on the abnormal event subgraph. It uses the relational graph convolutional network in the graph neural network to identify the affected compliance requirements and the scope of risk impact. The risk quantification assessment unit is used to calculate the risk score for each affected compliance requirement by combining the confidence level of the abnormal event, the length of the risk propagation path, and the severity level weight of the compliance requirement. It outputs the risk correlation analysis results, including a list of high-risk compliance items, a risk propagation path diagram, and risk scores.

9. The cloud-native application security monitoring and compliance auditing method based on big data analytics as described in claim 8, characterized in that, The process by which the risk quantification assessment unit calculates the risk score is as follows: Based on the confidence level of the abnormal event and the attenuation factor of the risk propagation path, the initial impact value of the abnormal event on various compliance requirements is calculated. Calculate the risk score by combining the predefined severity levels of compliance requirements in the compliance knowledge graph; When multiple abnormal events simultaneously affect the same compliance requirement, the comprehensive risk value is calculated using a risk accumulation method. By combining the time decay factor, the risk events that have been dealt with in the past are downweighted, and the calculated risk scores are compared with preset thresholds to classify the risk levels, including emergency, high risk, medium risk and low risk. If the risk is urgent or high-risk, the real-time alarm mechanism of the audit report generation module will be triggered. If the risk level is medium or low, it will be summarized and displayed in the periodic audit report.

10. The cloud-native application security monitoring and compliance auditing method based on big data analytics according to claim 1, characterized in that, The audit report generation module includes a differentiated strategy execution unit, an evidence chain tracing unit, and a dynamic report generation unit, among which: The differentiated strategy execution unit is used to execute differentiated automated response strategies based on the risk level and risk type output by the risk correlation analysis module. The evidence chain tracing unit is used to associate the risk propagation path output by the risk association analysis module with the original data, and extract the original logs, configuration change records and network traffic packets within the time window before and after the occurrence of the abnormal event as evidence to form a traceable evidence chain. The dynamic report generation unit integrates the response results of the differentiated strategy execution unit and the evidence data of the evidence chain tracing unit to dynamically generate real-time compliance audit reports that include a risk overview, compliance status heatmap, risk propagation path visualization, evidence chain list, and response and handling records. It also supports exporting to multiple formats as needed.

Images