Method, device and electronic equipment for predicting security threats of microservice cluster
By constructing graph-structured data and a multi-level security threat prediction model, the problem of insufficient accuracy in threat identification in microservice clusters is solved, and full-chain threat identification and multi-layered security protection for microservice clusters are realized.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- BEIJING UNISGUARD TECH CO LTD
- Filing Date
- 2026-04-02
- Publication Date
- 2026-06-02
AI Technical Summary
Existing technologies struggle to accurately and efficiently identify potential security threats in microservice clusters, especially in microservice architectures with dynamic topologies and complex threat propagation patterns. Traditional threat modeling techniques are ill-suited for this, resulting in insufficient identification accuracy and inadequate protection.
We construct graph-structured data and use machine learning models to predict security threats, including node classification, interaction frequency analysis, redundant edge removal, and random walk sampling. Combined with multi-level security threat prediction models, we identify the correlation between basic vulnerabilities, data leaks, service paralysis, and architectural penetration layers.
It enables full-chain threat identification for microservice clusters, accurately locates vulnerabilities in individual services, tracks data leakage paths, predicts cascading failure risks, provides multi-layered security protection, and improves identification accuracy and protection capabilities.
Smart Images
Figure CN122137663A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and in particular to a method, apparatus, and electronic device for predicting security threats in microservice clusters. Background Technology
[0002] Driven by cloud computing and distributed technologies, microservice architecture has become the mainstream model for enterprise application development due to its advantages such as modularity, scalability, and ease of deployment, significantly improving system development efficiency and business agility. However, its distributed nature greatly broadens the attack surface, and the intricate inter-service call relationships and data links make it difficult for traditional threat modeling techniques to adapt to the dynamic topology and threat propagation patterns of microservice architectures, revealing serious limitations.
[0003] Current microservice threat modeling technologies suffer from multiple shortcomings: the traditional manual approach of sorting out service relationships is inefficient, prone to overlooking potential risks due to oversights, and unable to cope with the frequent changes in the dynamic scaling of microservices; traditional machine learning-based modeling methods often treat microservice nodes as isolated samples, ignoring core correlation information such as service call dependencies and data flow, resulting in insufficient threat identification accuracy and an inability to accurately predict the spread path and impact range of threats in the cluster, making it difficult to support forward-looking security protection decisions.
[0004] Therefore, how to accurately and efficiently identify potential security threats to microservice clusters is a technical problem that urgently needs to be solved. Summary of the Invention
[0005] This invention provides a method, apparatus, and electronic device for predicting security threats in microservice clusters, in order to address the deficiencies in related technologies.
[0006] This invention provides a method for predicting security threats in microservice clusters, comprising: Obtain the operational data of the target microservice cluster; construct the graph structure data of the target microservice cluster based on the operational data; process the graph structure data using a security threat prediction model to obtain the security threat prediction results of the target microservice cluster; wherein, the security threat prediction model is a trained machine learning model, and the security threat prediction results include the prediction results of a first security threat, a second security threat, a third security threat, and a fourth security threat, wherein the first security threat is associated with the basic vulnerability layer, the second security threat is associated with the data leakage layer, the third security threat is associated with the service paralysis layer, and the fourth security threat is associated with the architecture penetration layer.
[0007] According to a security threat prediction method for a microservice cluster provided by the present invention, the step of constructing graph structure data of the target microservice cluster based on the operational data includes: classifying each microservice node in the target microservice cluster according to node type to obtain multiple microservice node groups; for each microservice node group, calculating the average interaction frequency of all microservice nodes in the microservice node group within a preset time period as the first benchmark interaction frequency of the microservice node group; determining that if the interaction frequency of any microservice node in the microservice node group within the preset time period is lower than a preset percentage threshold of the first benchmark interaction frequency, and the cumulative no-interaction time within the preset time period exceeds a preset time threshold, the microservice node is determined to be an invalid node; removing operational data associated with the invalid node from the operational data to obtain operational data of valid nodes; and constructing graph structure data of the target microservice cluster based on the operational data of the valid nodes.
[0008] According to the security threat prediction method for a microservice cluster provided by the present invention, the step of constructing graph structure data of the target microservice cluster based on the operational data includes: A pair of microservice nodes is identified as having multiple edges with the same transmission protocol and interaction timing; wherein, the pair of microservice nodes consists of two related microservice nodes; the average interaction frequency corresponding to the multiple edges is calculated; if there is an edge among the multiple edges whose interaction frequency differs from the average interaction frequency by less than a preset difference threshold, the edge is identified as a redundant edge; the redundant edge is removed from the multiple edges of the microservice node pair.
[0009] According to the security threat prediction method for a microservice cluster provided by the present invention, the step of constructing graph structure data of the target microservice cluster based on the operational data includes: The microservice nodes in the target microservice cluster are classified according to node type to obtain multiple microservice node groups. For the running data of each microservice node within a microservice node group for a preset numerical type, the following operations are performed: The mean and standard deviation of the running data for the preset numerical type of each microservice node are determined; the difference between the running data for the preset numerical type of each microservice node and the mean is determined to obtain the difference value of the running data for the preset numerical type of each microservice node; the Z-Score value of the running data for the preset numerical type of each microservice node is obtained based on the mean and the standard deviation; the running data for the preset numerical type of each microservice node is normalized based on the maximum value among the running data for the preset numerical type of each microservice node to obtain the normalized value of the running data for the preset numerical type of each microservice node; and the feature value corresponding to the running data for the preset numerical type of each microservice node is determined based on the difference value, Z-Score value, and normalized value of the running data for the preset numerical type of each microservice node.
[0010] According to the security threat prediction method for a microservice cluster provided by the present invention, the step of constructing graph structure data of the target microservice cluster based on the operational data includes: The target microservice cluster is divided into multiple subgraphs based on coreity indicators; the time range of the running data is divided into multiple time windows based on service call sequence; random walk sampling is performed on the running data within each time window corresponding to each subgraph; the graph structure data of the target microservice cluster is constructed based on the running data obtained from the random walk sampling; wherein, during the random walk sampling process, if the running data to be sampled for any microservice node or edge in the subgraph has associated labeled data, the data to be sampled is retained; wherein, the associated labeled data is the running data associated with the current sampled data in the next time window.
[0011] According to the security threat prediction method for microservice clusters provided by the present invention, the security threat prediction model is trained in the following manner: Obtain a training dataset; based on the training dataset, train the initial security threat prediction model using a loss function to obtain the trained security threat prediction model; wherein, the training dataset includes labeled sample data, which is obtained based on the historical operating data of the target microservice cluster, and the labels carried by the sample data include a first security threat label, a second security threat label, a third security threat label, and a fourth security threat label corresponding to the historical operating data, wherein the first security threat label is a security threat associated with the basic vulnerability layer, the second security threat label is a security threat associated with the data leakage layer, the third security threat label is a security threat associated with the service paralysis layer, and the fourth security threat label is a security threat associated with the architecture penetration layer.
[0012] According to a security threat prediction method for a microservice cluster provided by the present invention, the loss function includes a penalty term; wherein the penalty term is used to: increase the value of the loss function when multiple security threat prediction results with strong negative correlation are simultaneously predicted to exist; and decrease the value of the loss function when multiple security threat prediction results with strong positive correlation are simultaneously predicted to exist.
[0013] According to the security threat prediction method for microservice clusters provided by the present invention, the penalty term is expressed by the following formula: ; in, The number of labels carried by the sample data. For the security threat prediction model to predict the first i The nth sample data exists in the first The probability of such security threats; For the security threat prediction model to predict the first i The nth sample data exists in the first The probability of such security threats; These are elements of the label association matrix, used to represent the first... Class and the The degree of correlation between different types of security threats, if the first Class and the There is a strong negative correlation between these types of security threats. If it is a positive number; if the first Class and the There is a strong positive correlation between these types of security threats. If it is a negative number; if the first Class and the When there is no correlation between the types of security threats, Take 0.
[0014] The present invention also provides a security threat prediction device for microservice clusters, comprising: The system includes an acquisition module for acquiring operational data of the target microservice cluster; a construction module for constructing graph structure data of the target microservice cluster based on the operational data; and a prediction module for processing the graph structure data using a security threat prediction model to obtain security threat prediction results for the target microservice cluster. The security threat prediction model is a trained machine learning model, and the security threat prediction results include prediction results for a first security threat, a second security threat, a third security threat, and a fourth security threat. The first security threat is associated with a basic vulnerability layer, the second security threat with a data leakage layer, the third security threat with a service paralysis layer, and the fourth security threat with an architecture penetration layer.
[0015] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the security threat prediction method for microservice clusters as described above.
[0016] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the security threat prediction method for microservice clusters as described above.
[0017] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the security threat prediction method for microservice clusters as described above.
[0018] The security threat prediction method, apparatus, and electronic device for microservice clusters provided by this invention can comprehensively depict the dynamic relationships between microservice nodes by acquiring the operational data of the target microservice cluster and constructing graph structure data, providing a structured analysis foundation for security threat prediction. Utilizing a trained multi-level security threat prediction model to process the graph data, security threats are divided into a four-level relational system: basic vulnerability layer, data leakage layer, service paralysis layer, and architecture penetration layer, achieving full-chain threat identification from local vulnerabilities to system penetration. This effectively solves the fragmented identification problem caused by neglecting service relationships in traditional methods. It can accurately locate basic vulnerabilities in a single service (first security threat), trace data leakage paths across services (second security threat), predict the risk of service paralysis caused by cascading failures (third security threat), and finally identify penetration attacks targeting the weaknesses of the microservice cluster (fourth security threat), providing microservice clusters with multi-layered security protection capabilities covering "point-line-surface-volume". Attached Figure Description
[0019] To more clearly illustrate the technical solutions in this invention or related technologies, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0020] Figure 1 This is a flowchart illustrating the security threat prediction method for microservice clusters provided by this invention.
[0021] Figure 2 This is a flowchart illustrating the training method for the security threat prediction model provided by the present invention.
[0022] Figure 3 This is a schematic diagram of the security threat prediction system for microservice clusters provided by the present invention.
[0023] Figure 4 This is a schematic diagram of the security threat prediction device for microservice clusters provided by the present invention.
[0024] Figure 5 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation
[0025] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.
[0026] The following is combined Figures 1-3 This invention describes a security threat prediction method for microservice clusters.
[0027] Figure 1 This is a flowchart illustrating the security threat prediction method for microservice clusters provided by this invention. Figure 1 As shown, the security threat prediction method for microservice clusters includes the following steps.
[0028] Step 101: Obtain the runtime data of the target microservice cluster.
[0029] The target microservice cluster is a system composed of multiple collaborative, independently deployed microservice nodes. These nodes are interconnected through service calls and data flow to jointly complete specific business functions. Each microservice node is responsible for implementing a part of the system's functionality and interacts with other microservice nodes through lightweight communication mechanisms (such as RESTful APIs, message queues, etc.).
[0030] Operational data refers to various types of information generated during the operation of a microservice cluster, including microservice node information (e.g., name, function, deployment location, and interface parameters), inter-service call relationship information (e.g., synchronous and asynchronous calls, call frequency, and transport protocol), data flow information (e.g., data type, transmission path, and storage location), and infrastructure information (e.g., server, container, and database deployment and operation information).
[0031] For example, the operational data of a microservice cluster on an e-commerce platform may include the frequency of user service calls to the order service, the transmission path of order data from the order service to the payment service, etc.
[0032] In the specific implementation process, it can be done through, for example... Figure 3 The data acquisition module shown collects full information from the target microservice cluster and supports multi-source data access; it performs preliminary cleaning on the collected raw data, removing obviously erroneous or invalid data entries to ensure the integrity and accuracy of the data.
[0033] Step 102: Based on the running data, construct the graph structure data of the target microservice cluster.
[0034] In some embodiments, the microservice nodes in the target microservice cluster can be classified according to node type (e.g., core services, non-core services, infrastructure) to obtain multiple microservice node groups. For each microservice node group, the average interaction frequency of all microservice nodes in the group within a preset time period (e.g., the past 24 hours) is calculated as the first baseline interaction frequency of the microservice node group. If the interaction frequency of any microservice node in the group within the preset time period is lower than a preset percentage threshold (e.g., 30%) of the first baseline interaction frequency, and the cumulative no-interaction time within the preset time period exceeds a preset duration threshold (e.g., 48 hours or 72 hours), then the microservice node is determined to be an invalid node. The running data associated with invalid nodes is removed from the running data to obtain the running data of valid nodes. Based on the running data of valid nodes, the graph structure data of the target microservice cluster is constructed.
[0035] In the embodiments provided by the present invention, the above-mentioned dynamic threshold cleaning mechanism effectively eliminates redundant nodes and long-term idle services in the target microservice cluster, avoids interference from invalid data on security threat modeling, and retains key low-frequency interaction edges to capture abnormal behavior characteristics.
[0036] In the specific implementation process, based on the operational data of the effective nodes, unique identifiers and attribute labels can be assigned to each microservice node, each infrastructure node, and each interface node according to the preset node classification rules. Directed edges can be constructed according to the service call sequence and data transmission direction to represent the relationship between nodes, thus constructing the graph structure data of the target microservice cluster.
[0037] In some embodiments, multiple edges with the same transport protocol and interaction timing can be identified between any pair of microservice nodes; wherein, the pair of microservice nodes consists of two related microservice nodes; the average interaction frequency corresponding to the multiple edges is calculated; if there is an edge among the multiple edges whose interaction frequency differs from the average interaction frequency by less than a preset difference threshold (e.g., 5%), the edge is identified as a redundant edge; redundant edges are removed from the multiple edges of the microservice node pair. Furthermore, key low-frequency edges with an interaction frequency higher than twice the average are retained to optimize the redundancy of the graph structure data.
[0038] In the embodiments provided by the present invention, redundant edges are removed from multiple edges of microservice node pairs using the above method, which effectively optimizes the redundancy of graph structure data, avoids the waste of computing resources and interference with model training caused by redundant edges, and ensures that key low-frequency interaction information is not missed.
[0039] In some embodiments, the microservice nodes in the target microservice cluster can be classified according to node type (e.g., core services, non-core services, infrastructure, etc.) to obtain multiple microservice node groups; for the running data of the preset numerical type of each microservice node in the microservice node group, the following operations are performed: Determine the mean and standard deviation of the runtime data of a preset numerical type for each microservice node. The preset numerical data type can be numerical runtime data such as call frequency and response time.
[0040] The difference between the running data of the preset numerical type of each microservice node and the mean is determined, thus obtaining the difference value of the running data of the preset numerical type of each microservice node.
[0041] Based on the mean and standard deviation, the Z-Score value of the running data of each microservice node in the preset numerical type is obtained.
[0042] Based on the maximum value in the predefined numerical data of each microservice node, the predefined numerical data of each microservice node is normalized to obtain the normalized value of the predefined numerical data of each microservice node. For example, the ratio between the predefined numerical data of each microservice node and the maximum value can be calculated to obtain the normalized value of the predefined numerical data of each microservice node.
[0043] Based on the difference value, Z-Score value, and normalized value of the running data of the preset numerical type for each microservice node, the feature value corresponding to the running data of the preset numerical type for each microservice node is determined. For example, the feature value corresponding to the running data of the preset numerical type for each microservice node can be obtained by concatenating the difference value, Z-Score value, and normalized value.
[0044] In the embodiments provided by this invention, the feature values corresponding to the preset numerical types of running data of each microservice node are determined based on the difference value, Z-Score value, and normalized value of the running data of each microservice node. This can effectively eliminate the influence of different dimensions and distributions on data analysis, enhance the comparability between numerical features, and retain the fluctuation information of the original data. This significantly improves the perception accuracy of the security threat prediction model on the running status of microservice nodes, providing more accurate and comprehensive data support for subsequent security threat identification, thereby improving the reliability and practicality of threat modeling of the target microservice cluster.
[0045] In some embodiments, for the categorical features of each microservice node, the average frequency of occurrence over the last three time-series windows can be added as a supplementary feature on the basis of one-hot encoding.
[0046] In some embodiments, each microservice node in the target microservice cluster can be divided into multiple subgraphs according to its coreity index; the time range of the running data can be divided into multiple time windows according to the service call sequence; random walk sampling can be performed on the running data within each time window corresponding to each subgraph; the graph structure data of the target microservice cluster can be constructed based on the running data obtained from the random walk sampling; wherein, during the random walk sampling process, if the running data to be sampled for any microservice node or edge in the subgraph has associated labeled data, the data to be sampled is retained; wherein, the associated labeled data is the running data associated with the current sampled data in the next time window.
[0047] Random walk is a graph traversal algorithm that starts from a node in the graph and randomly selects neighboring nodes to visit.
[0048] Core metrics may include, but are not limited to, business criticality and call frequency.
[0049] In the embodiments provided by this invention, each microservice node in the target microservice cluster is divided into multiple subgraphs according to its coreity index, and the runtime data is divided into multiple time-series windows according to the service call sequence. Random walk sampling based on node importance is performed on the data within the time-series window corresponding to each subgraph, prioritizing the retention of nodes and edges that interact with the labeled data associated with the next time-series window. This effectively ensures that the sampled subgraphs cover core nodes and time-series critical propagation links. Simultaneously, by guiding the associated labeled data, the ability of the security threat prediction model to capture dynamic time-series features is enhanced, avoiding the critical path omission problem caused by traditional static sampling. Ultimately, a graph structure data that more closely reflects the actual operating state is constructed, significantly improving the accuracy of security threat prediction and the adaptability of the security threat prediction model to the dynamic changes of the target microservice cluster.
[0050] Step 103: Use the security threat prediction model to process the graph structure data and obtain the security threat prediction results for the target microservice cluster.
[0051] The security threat prediction model is a trained machine learning model used to predict potential security threats in a microservice cluster. For example, it can predict a security threat at the basic vulnerability layer on a microservice node, or a security threat at the data leakage layer in a service call path.
[0052] In practice, security threat prediction models can be constructed in various ways, without being limited by the description in this manual.
[0053] In some embodiments, the security threat prediction model may include the following modules: The feature extraction submodule employs a multi-layer improved graph convolutional network with 3×3 convolutional kernels to fuse and extract local topological and attribute features of each microservice node. It captures multi-level neighbor association information of nodes through convolutional operations, providing rich feature representations for subsequent threat classification.
[0054] The capture of multi-level neighbor association information is based on the following formula: ; in, For the first After convolution, nodes The fused feature vector, The number of convolutional layers. For activation function, This is a normalized adjacency matrix of the microservice architecture graph (the graph structure data of the target microservice cluster). for The degree matrix, For the first After convolution, nodes eigenvectors, For the first The learnable weight matrix of the layer, For the first The bias vector of the layer.
[0055] In practice, through two layers of convolutional iterative calculation, the layer-by-layer aggregation of multi-order neighbor association features can be achieved, as follows: The first layer, i.e. =1, aggregation node The first-order neighbor features, output ; The second layer, namely =2, based on Further aggregate the neighbors of first-order neighbors, i.e., nodes The second-order neighbor features, output Complete the capture of multi-level neighbor association information.
[0056] The attention interaction submodule employs a graph attention network with a multi-head attention mechanism, dynamically weighting the contributions of different neighboring nodes. It can enhance the feature representation of key threat propagation paths based on the strength and importance of the associations between nodes, thereby improving the accuracy of threat identification.
[0057] The threat classification submodule includes a hierarchical attention unit and a dynamic threshold adaptation unit.
[0058] In practice, the threat classification submodule uses the multi-dimensional node features output by the feature extraction submodule to achieve accurate classification of security threats through a hierarchical reasoning mechanism.
[0059] Hierarchical attention units are used for: The hierarchical feature initialization divides node features into four initial representations based on their potential severity: the basic vulnerability layer, focusing on unpatched CVE vulnerabilities, weak password policies, and other node-specific vulnerabilities; the data leakage layer, focusing on data security risks such as unencrypted communication and sensitive data exposure; the service paralysis layer, capturing availability threats such as resource exhaustion and denial-of-service attacks; and the architecture penetration layer, identifying system architecture-level threats such as unauthorized access and privilege escalation attacks.
[0060] Inter-level dependency quantification uses Graph Attention Network (GAT) to dynamically weight the contribution of neighboring nodes, thereby strengthening the propagation path of key threats (such as the architecture penetration layer having a higher weight on the data leakage layer and the service paralysis layer).
[0061] Dynamic weight allocation and threshold adaptation are employed. A hierarchical attention mechanism is used to generate query vectors, and similarity scores are calculated by matching features at each level. Attention weights are obtained by Softmax normalization.
[0062] The classification and results are integrated by training an independent classifier for each level (e.g., a fully connected layer + Softmax) to output the probability of each type of security threat (e.g., the probability of "SQL injection vulnerability" is output for the basic vulnerability layer).
[0063] Combined with the dynamic threshold adaptation unit, the confidence thresholds for the probability of various types of security threats are set differently according to the coreness of the microservice nodes: for core nodes, a weighted threshold is used to reduce the risk of false negatives (such as critical services in the architecture penetration layer); for non-core nodes, the threshold is appropriately relaxed to balance the false positive rate (such as basic vulnerabilities in edge services).
[0064] The security threat prediction results include predictions for the first security threat, the second security threat, the third security threat, and the fourth security threat.
[0065] The prediction results of the first security threat are correlated with the underlying vulnerability layer. For example, the security threat prediction model predicts that a certain microservice node has underlying security vulnerabilities such as SQL injection vulnerabilities or cross-site scripting (XSS) vulnerabilities.
[0066] The prediction results of the second security threat are related to the data breach layer. For example, the security threat prediction model predicts that there is a data breach risk in a certain service call path, such as sensitive information (such as user passwords and personal information) not being encrypted or improperly handled during transmission.
[0067] The prediction results of the third security threat are associated with the service paralysis layer. For example, the security threat prediction model predicts that a microservice node will become unavailable due to a DDoS attack or resource exhaustion, thereby affecting the normal operation of the entire system.
[0068] The fourth security threat prediction results are correlated with the architecture penetration layer. For example, the security threat prediction model predicts that attackers will exploit weaknesses in the system architecture (such as unauthorized API interfaces or weak authentication mechanisms) to gain high-level privileges or control of the system.
[0069] In the specific implementation process, such as Figure 3 As shown, the security threat prediction system for microservice clusters also includes a threat assessment and visualization module. This module is used to quantify and assess risks based on the output of the security threat prediction model, generate a risk assessment report, and provide a visualization interface to intuitively display the microservice architecture topology, threat distribution, propagation paths, and risk levels. The system also includes a threat knowledge base module, which stores threat type definitions, attack signature databases, risk level standards, and historical threat data, providing data support for the training of the security threat prediction model and risk assessment.
[0070] Figure 2This is a flowchart illustrating the training method of the security threat prediction model provided by this invention. Figure 2 As shown, the training method for the security threat prediction model includes the following steps.
[0071] Step 201: Obtain the training dataset.
[0072] The training dataset includes labeled sample data, which is obtained from the historical operation data of the target microservice cluster. The labels carried by the sample data include a first security threat label, a second security threat label, a third security threat label, and a fourth security threat label corresponding to the historical operation data. The first security threat label is a security threat associated with the basic vulnerability layer, the second security threat label is a security threat associated with the data leakage layer, the third security threat label is a security threat associated with the service paralysis layer, and the fourth security threat label is a security threat associated with the architecture penetration layer.
[0073] Step 202: Based on the training dataset, train the initial security threat prediction model using the loss function to obtain the trained security threat prediction model.
[0074] In the specific implementation process, sample data can be input into the initial security threat prediction model. The initial security threat prediction model outputs the prediction results for the first, second, third, and fourth security threats. A loss function is used to calculate the difference between the prediction results for each security threat and the labels of the sample data. A preset optimization algorithm (such as gradient descent) is used to adjust the parameters of the initial security threat prediction model until the training termination condition is met, resulting in the trained security threat prediction model. The training termination condition may include: model convergence or reaching a preset number of training iterations.
[0075] In some embodiments, the loss function includes a penalty term; wherein the penalty term is used to: increase the value of the loss function when multiple security threat predictions with strong negative correlations are simultaneously predicted to exist; and decrease the value of the loss function when multiple security threat predictions with strong positive correlations are simultaneously predicted to exist.
[0076] The penalty term is expressed by the following formula: ; in, The number of labels carried by the sample data. For the security threat prediction model to predict the first i The nth sample data exists in the first The probability of such security threats; For the security threat prediction model to predict the first i The nth sample data exists in the first The probability of such security threats; These are elements of the label association matrix, used to represent the first... Class and the The degree of correlation between different types of security threats, if the first Class and the There is a strong negative correlation between these types of security threats. If it is a positive number; if the first Class and the There is a strong positive correlation between these types of security threats. If it is a negative number; if the first Class and the When there is no correlation between the types of security threats, Take 0.
[0077] In some embodiments, the loss function is the cross-entropy loss function, which includes the penalty term described above. This loss function is expressed by the following formula: ; in, For the total loss function, The basic cross-entropy loss term, For tag-related penalty items, The penalty coefficient is... The number of training samples. The total number of threat tags, For the first The first sample Each tag contains a true value: 1 indicates the threat exists, and 0 indicates it does not exist. For the model to predict the existence of the i-th sample, the first... The probability of a threat; These are elements of the label association matrix, used to represent the first... Class and the The degree of correlation between two types of threats; if there is a strong negative correlation between two types of threats, meaning they rarely occur simultaneously, A positive number is used to penalize cases where both are predicted to exist simultaneously. This is indicated if a strong positive correlation exists, meaning they frequently occur at the same time. When negative numbers are taken, there is no significant correlation. Take 0.
[0078] In the embodiments provided by this invention, a penalty term is introduced into the loss function to dynamically adjust the loss value of the security threat prediction results: when multiple security threats with strong negative correlations are predicted to exist simultaneously, the penalty term increases the loss function value to suppress erroneous associations; when multiple security threats with strong positive correlations are predicted simultaneously, the penalty term decreases the loss function value to strengthen reasonable associations. This effectively solves the problem of neglecting label associations in traditional threat classification, leading to singular identification, and significantly improves the accuracy of simultaneous identification of multiple security threats.
[0079] The computing device based on an in-memory computing device array provided by the present invention will be described below. The computing device based on an in-memory computing device array described below and the computing method based on an in-memory computing device array described above can be referred to in correspondence.
[0080] Figure 4 This is a schematic diagram of the security threat prediction device for microservice clusters provided by the present invention. Figure 4 As shown, the security threat prediction device for microservice clusters includes the following modules.
[0081] The acquisition module 410 is used to acquire the running data of the target microservice cluster; The construction module 420 is used to construct the graph structure data of the target microservice cluster based on the running data; Prediction module 430 is used to process the graph structure data using a security threat prediction model to obtain the security threat prediction result of the target microservice cluster; The security threat prediction model is a trained machine learning model, and the security threat prediction results include prediction results for a first security threat, a second security threat, a third security threat, and a fourth security threat. The first security threat is associated with the basic vulnerability layer, the second security threat is associated with the data leakage layer, the third security threat is associated with the service paralysis layer, and the fourth security threat is associated with the architecture penetration layer.
[0082] Figure 5 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 5As shown, the electronic device may include: a processor 510, a communications interface 520, a memory 530, and a communication bus 540, wherein the processor 510, the communications interface 520, and the memory 530 communicate with each other through the communication bus 540. The processor 510 can call logical instructions in the memory 530 to execute the security threat prediction method for the microservice cluster provided in the above embodiments. The method includes: acquiring the running data of the target microservice cluster; constructing graph structure data of the target microservice cluster based on the running data; processing the graph structure data using a security threat prediction model to obtain the security threat prediction result of the target microservice cluster; wherein the security threat prediction model is a trained machine learning model, and the security threat prediction result includes the prediction result of a first security threat, the prediction result of a second security threat, the prediction result of a third security threat, and the prediction result of a fourth security threat, wherein the first security threat is associated with the basic vulnerability layer, the second security threat is associated with the data leakage layer, the third security threat is associated with the service paralysis layer, and the fourth security threat is associated with the architecture penetration layer.
[0083] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to related technologies, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0084] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the security threat prediction method for microservice clusters provided in the above embodiments. The method includes: acquiring the running data of a target microservice cluster; constructing graph structure data of the target microservice cluster based on the running data; processing the graph structure data using a security threat prediction model to obtain a security threat prediction result for the target microservice cluster; wherein the security threat prediction model is a trained machine learning model, and the security threat prediction result includes a prediction result for a first security threat, a prediction result for a second security threat, a prediction result for a third security threat, and a prediction result for a fourth security threat. The first security threat is associated with a basic vulnerability layer, the second security threat is associated with a data leakage layer, the third security threat is associated with a service paralysis layer, and the fourth security threat is associated with an architecture penetration layer.
[0085] In another aspect, the present invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the security threat prediction method for microservice clusters provided in the above embodiments. The method includes: acquiring operational data of a target microservice cluster; constructing graph structure data of the target microservice cluster based on the operational data; processing the graph structure data using a security threat prediction model to obtain a security threat prediction result for the target microservice cluster; wherein the security threat prediction model is a trained machine learning model, and the security threat prediction result includes prediction results for a first security threat, a second security threat, a third security threat, and a fourth security threat, wherein the first security threat is associated with a basic vulnerability layer, the second security threat is associated with a data leakage layer, the third security threat is associated with a service paralysis layer, and the fourth security threat is associated with an architecture penetration layer.
[0086] The computer-readable storage medium can be either a non-transitory computer-readable storage medium or a transient computer-readable storage medium; no specific limitation is made here.
[0087] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.
[0088] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the parts that contribute to the related technology, can be embodied in the form of software products. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.
[0089] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A method for predicting security threats in a microservice cluster, characterized in that, include: Obtain runtime data for the target microservice cluster; Based on the operational data, construct the graph structure data of the target microservice cluster; By using a security threat prediction model to process the graph structure data, the security threat prediction results for the target microservice cluster are obtained. The security threat prediction model is a trained machine learning model, and the security threat prediction results include prediction results for a first security threat, a second security threat, a third security threat, and a fourth security threat. The first security threat is associated with the basic vulnerability layer, the second security threat is associated with the data leakage layer, the third security threat is associated with the service paralysis layer, and the fourth security threat is associated with the architecture penetration layer.
2. The security threat prediction method for microservice clusters according to claim 1, characterized in that, The step of constructing the graph structure data of the target microservice cluster based on the operational data includes: The microservice nodes in the target microservice cluster are classified according to node type to obtain multiple microservice node groups; For each microservice node group, the average interaction frequency of all microservice nodes in the microservice node group within a preset time period is calculated as the first baseline interaction frequency of the microservice node group. If any microservice node in the microservice node group has an interaction frequency lower than a preset percentage threshold of the first baseline interaction frequency within the preset time period, and the cumulative no-interaction time within the preset time period exceeds a preset time threshold, then the microservice node is determined to be an invalid node. The running data associated with the invalid nodes is removed from the running data to obtain the running data of the valid nodes; Based on the operational data of the valid nodes, construct the graph structure data of the target microservice cluster.
3. The security threat prediction method for microservice clusters according to claim 1, characterized in that, The step of constructing the graph structure data of the target microservice cluster based on the operational data includes: It is determined that there are multiple edges between any pair of microservice nodes that have the same transport protocol and interaction timing; wherein, the pair of microservice nodes is two microservice nodes with an association relationship; Calculate the average interaction frequency corresponding to the plurality of edges; If there is an edge among the plurality of edges whose interaction frequency differs from the average interaction frequency by less than a preset difference threshold, the edge is determined to be a redundant edge. Redundant edges are removed from the multiple edges of the microservice node pair.
4. The security threat prediction method for microservice clusters according to claim 1, characterized in that, The step of constructing the graph structure data of the target microservice cluster based on the operational data includes: The microservice nodes in the target microservice cluster are classified according to node type to obtain multiple microservice node groups; For the runtime data of the preset numerical type of each microservice node within the microservice node group, perform the following operations: Determine the mean and standard deviation of the runtime data of the preset numerical types for each microservice node; The difference between the running data of the preset numerical type of each microservice node and the mean value is determined to obtain the difference value of the running data of the preset numerical type of each microservice node. Based on the mean and the standard deviation, the Z-Score value of the running data of each microservice node of the preset numerical type is obtained; Based on the maximum value in the running data of the preset numerical type of each microservice node, the running data of the preset numerical type of each microservice node is normalized to obtain the normalized value of the running data of the preset numerical type of each microservice node. Based on the difference value, Z-Score value, and normalized value of the running data of the preset numerical type of each microservice node, determine the feature value corresponding to the running data of the preset numerical type of each microservice node.
5. The security threat prediction method for microservice clusters according to claim 1, characterized in that, The step of constructing the graph structure data of the target microservice cluster based on the operational data includes: The microservice nodes in the target microservice cluster are divided into multiple subgraphs according to the coreness index; The time range of the running data is divided into multiple time windows according to the service call sequence; For the runtime data within each time window corresponding to each subgraph, random walk sampling is performed; Based on the running data obtained from the random walk sampling, construct the graph structure data of the target microservice cluster; During the random walk sampling process, if any microservice node or edge in the subgraph has associated labeled data for its sampled running data, the sampled data is retained; wherein, the associated labeled data is the running data associated with the current sampled data in the next time window.
6. The security threat prediction method for microservice clusters according to claim 1, characterized in that, The security threat prediction model is trained using the following method: Obtain the training dataset; Based on the training dataset, the initial security threat prediction model is trained using a loss function to obtain the trained security threat prediction model. The training dataset includes labeled sample data, which is obtained from the historical operation data of the target microservice cluster. The labels carried by the sample data include a first security threat label, a second security threat label, a third security threat label, and a fourth security threat label corresponding to the historical operation data. The first security threat label is a security threat associated with the basic vulnerability layer, the second security threat label is a security threat associated with the data leakage layer, the third security threat label is a security threat associated with the service paralysis layer, and the fourth security threat label is a security threat associated with the architecture penetration layer.
7. The security threat prediction method for microservice clusters according to claim 6, characterized in that, The loss function includes a penalty term; Wherein, the penalty term is used for: When multiple security threat predictions with strong negative correlations are simultaneously predicted to exist, the value of the loss function is increased. When multiple security threat predictions with strong positive correlations are simultaneously predicted to exist, the value of the loss function is reduced.
8. The security threat prediction method for microservice clusters according to claim 7, characterized in that, The penalty term is expressed by the following formula: ； in, The number of labels carried by the sample data. For the security threat prediction model to predict the first i The nth sample data exists in the first The probability of such security threats; For the security threat prediction model to predict the first i The nth sample data exists in the first The probability of such security threats; These are elements of the label association matrix, used to represent the first... Class and the The degree of correlation between different types of security threats, if the first Class and the There is a strong negative correlation between these types of security threats. If it is a positive number; if the first Class and the There is a strong positive correlation between these types of security threats. If it is a negative number; if the first Class and the When there is no correlation between the types of security threats, Take 0.
9. A security threat prediction device for a microservice cluster, characterized in that, include: The acquisition module is used to acquire runtime data of the target microservice cluster; A construction module is used to construct the graph structure data of the target microservice cluster based on the runtime data; The prediction module is used to process the graph structure data using a security threat prediction model to obtain the security threat prediction results for the target microservice cluster. The security threat prediction model is a trained machine learning model, and the security threat prediction results include prediction results for a first security threat, a second security threat, a third security threat, and a fourth security threat. The first security threat is associated with the basic vulnerability layer, the second security threat is associated with the data leakage layer, the third security threat is associated with the service paralysis layer, and the fourth security threat is associated with the architecture penetration layer.
10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the security threat prediction method for microservice clusters as described in any one of claims 1-8.