A cloud and terminal interaction information security analysis method

Abstract

The present application relates to a kind of cloud and terminal interaction information security analysis method, belong to information security field, in the method, in two adjacent analysis time, total analysis computing power budget is respectively concentrated in different parts of first feature resource block set and second feature resource block set, rather than traversing all feature resource blocks at each time occasion.This makes the computing power of each analysis time focused on part of information feature type, without increasing the total computing power overhead, improves the detection depth obtained by the analyzed feature.At the same time, since the feature types analyzed by adjacent time are at least partially different, multiple times can still cover all feature types after accumulation, so as to realize the accuracy of considering overhead and detection.

Description

Technical Field

[0001] This invention belongs to the field of information security and relates to an information security analysis method for cloud-terminal interaction. Background Technology

[0002] With the rapid development of cloud computing technology, data interaction between terminal devices and the cloud is becoming increasingly frequent, and the amount of sensitive information involved in this interaction is growing exponentially. In scenarios such as financial transactions, telemedicine, and industrial control, attacks on such interactions can directly lead to serious consequences such as data breaches and command tampering. Therefore, information security in cloud-terminal interactions has become a core issue concerning user privacy and system reliability, placing higher demands on security detection technologies. To address these threats, detection methods based on big data analytics or machine learning models can be employed. These solutions collect multi-dimensional information such as traffic characteristics, protocol behavior, and load statistics of interactions between the cloud and terminals, and use pre-trained detection models to perform in-depth analysis of this information to identify potential malicious behaviors or abnormal patterns.

[0003] However, as the scale of data interaction increases, the detection overhead required by the above methods is also relatively large. Therefore, how to balance the overhead and the accuracy of detection is a current research problem. Summary of the Invention

[0004] In view of this, the present invention provides an information security analysis method for cloud-terminal interaction to solve the above problems.

[0005] To achieve the above objectives, the present invention provides the following technical solution:

[0006] Firstly, a method for analyzing information security in cloud-terminal interactions is provided. This method is applied to an analysis resource scheduler and includes: acquiring a first global information feature set of information interacting between the cloud and the terminal within a first time period, and acquiring a second global information feature set of information interacting between the cloud and the terminal within a second time period adjacent to the first time period; dividing the first global information feature set into a first feature resource block set consisting of multiple feature resource blocks, and dividing the second global information feature set into a second feature resource block set consisting of multiple feature resource blocks; a feature resource block is the smallest set of information features that can be independently allocated analytical computing power, and the feature resource blocks obtained in both divisions contain the same type of information features; at a first time, allocating the total analytical computing power budget to a first portion of the feature resource blocks corresponding to the first feature resource block set for analysis, obtaining a first result; and at a second time, allocating the total analytical computing power budget to a second portion of the feature resource blocks corresponding to the second feature resource block set for analysis, obtaining a second result; the feature resource blocks analyzed at the first time and the feature blocks analyzed at the second time contain different types of information features, and the first and second results are used to jointly indicate whether there is an information security risk in the cloud-terminal interaction.

[0007] Therefore, this scheme concentrates the total analysis computing power budget on different parts of the first and second feature resource block sets in two adjacent analysis periods, instead of traversing all feature resource blocks in each period. This allows the computing power of each analysis period to focus on a portion of the information feature types, improving the detection depth of the analyzed features without increasing the total computing power overhead. Furthermore, since the feature types analyzed in adjacent periods are at least partially different, multiple periods can still cover all feature types, thus achieving a balance between cost and detection accuracy.

[0008] Optionally, the first part of the feature resource blocks contains N1 feature resource blocks, where the i-th feature resource block is the i-th of the N1 feature resource blocks, i iterates from 1 to N1, and N1 is an integer greater than 1. At a first opportune moment, the total analysis computing power budget is allocated to the first part of the feature resource blocks corresponding to the first feature resource block set for analysis, obtaining a first result. This includes: at the first opportune moment, based on the feature width and weight of the i-th feature resource block, allocating the total analysis computing power budget to the i-th feature resource block, triggering the detection model corresponding to the i-th feature resource block, and analyzing the i-th feature resource block based on the allocated analysis computing power budget to obtain the result i corresponding to the i-th feature resource block in the first result. Furthermore, the second part of the feature resource block contains N2 feature resource blocks, where the j-th feature resource block is the j-th of the N2 feature resource blocks, j iterates from 1 to N2, and N2 is an integer greater than 1. At the second timing, the total analysis computing power budget is concentratedly allocated to the second part of the feature resource block corresponding to the second feature resource block set for analysis, and the second result is obtained. This includes: at the second timing, based on the feature width of the j-th feature resource block and the weight corresponding to the j-th feature resource block, the total analysis computing power budget is allocated to the j-th feature resource block, and the detection model corresponding to the j-th feature resource block is triggered. The j-th feature resource block is analyzed based on the allocated analysis computing power budget to obtain the result j corresponding to the j-th feature resource block in the second result.

[0009] Therefore, the centralized allocation at each time point can be further refined into allocating total computing power based on the feature width and corresponding weight of each feature resource block, and triggering the respective detection models to perform analysis. The feature width represents the basic computing power required for the feature resource block to complete the baseline analysis, while the weight leaves room for differentiation in scheduling. This on-demand allocation and weighted allocation mechanism allows the analysis resource scheduler to preferentially allocate more computing power to the dimensions of focus while maintaining the total budget, thereby achieving a more flexible and targeted detection configuration capability under resource constraints.

[0010] Optionally, the analysis computing power budget allocated to the i-th feature resource block satisfies the following relationship:

[0011] P(i,1)=P_total*(w_i / w_total1)*α_i;

[0012] Where P(i,1) is the analysis computing power budget allocated to the i-th feature resource block, P_total is the total analysis computing power budget, w_i is the feature width of the i-th feature resource block, w_total1 is the total feature width of the first part of the feature resource blocks, and α_i is the weight corresponding to the i-th feature resource block.

[0013] The analysis computing budget allocated to the j-th feature resource block satisfies the following relationship:

[0014] P(j,2)=P_total*(w_j / w_total2)*α_j;

[0015] Where P(j,2) is the analysis computing power budget allocated to the j-th feature resource block, P_total is the total analysis computing power budget, w_j is the feature width of the j-th feature resource block, w_total2 is the total feature width of the second part of the feature resource blocks, and α_j is the weight corresponding to the j-th feature resource block.

[0016] Therefore, by introducing weighting coefficients, the computational power allocation relationship is quantified into a clear mathematical expression. The analytical computational power allocated to each feature resource block is determined by multiplying its basic proportion in the total feature width by the weighting coefficient. This relationship makes the allocation process no longer a simple proportional distribution; the weighting coefficient becomes an independent variable that regulates the detection depth of each dimension. When the weight of a feature resource block is increased, its allocated computational power budget increases accordingly, and the effect of computational power focusing can be quantitatively controlled, achieving a balance between detection accuracy and computational cost.

[0017] Optionally, the computing power density of the analysis computing power budget allocated to the i-th feature resource block satisfies the following relationship:

[0018] CD_i=P(i,1) / w_i; where CD_i is the computing power density of the analysis computing power budget allocated to the i-th feature resource block;

[0019] The computing power density of the analysis computing power budget allocated to the j-th feature resource block satisfies the following relationship:

[0020] CD_j=P(j,2) / w_j; where CD_j is the computing power density of the analysis computing power budget allocated to the j-th feature resource block;

[0021] Computational density is used to represent the detection depth at which analysis is performed.

[0022] Therefore, by defining computing power density as the ratio of the analytical computing power allocated to a single feature resource block to its feature width, computing power density directly reflects the detection depth for analyzing that feature dimension. The introduction of this concept transforms the previously difficult-to-quantify analytical granularity into a calculable and comparable metric. By comparing the computing power densities of different feature resource blocks, the scheduler can accurately grasp the current distribution of detection resources across the entire feature space.

[0023] Optionally, the detection model corresponding to the i-th feature resource block is triggered to analyze the i-th feature resource block based on the allocated analysis computing power budget, obtaining the result i corresponding to the i-th feature resource block in the first result. This includes: sending the i-th feature resource block and information indicating the allocated analysis computing power budget to the detection model corresponding to the i-th feature resource block, thereby receiving the result i returned by the detection model corresponding to the i-th feature resource block. The detection model corresponding to the i-th feature resource block is configured such that the analysis computing power used to analyze the i-th feature resource block does not exceed the allocated analysis computing power budget for the i-th feature resource block. The process involves: triggering the detection model corresponding to the j-th feature resource block, analyzing the j-th feature resource block based on the allocated analysis computing power budget, and obtaining the result j corresponding to the j-th feature resource block in the second result. This includes: sending the j-th feature resource block and the information indicating the allocated analysis computing power budget to the detection model corresponding to the j-th feature resource block, thereby receiving the result j returned by the detection model corresponding to the j-th feature resource block. The detection model corresponding to the j-th feature resource block is configured such that the analysis computing power used to analyze the j-th feature resource block does not exceed the allocated analysis computing power budget for the j-th feature resource block.

[0024] Therefore, the detection model receives the analysis computing power budget and constrains its own computational expenditure accordingly. When the analysis resource scheduler sends feature data to the detection model, it also includes the allocated computing power budget information for that model. The detection model is configured to ensure that the computing power used for analysis does not exceed this budget. This mechanism of budget allocation and model compliance ensures that the computing power allocation decisions made by the upper-level scheduler are effectively executed by the lower-level model, thereby achieving accurate closed-loop control from scheduling instructions to model behavior.

[0025] Optionally, N1 feature resource blocks are uniformly distributed in the first feature resource block set, and N2 feature resource blocks are uniformly distributed in the second feature resource block set. For example, uniform distribution of N1 feature resource blocks in the first feature resource block set means that the indices of the N1 feature resource blocks in the first feature resource block set are not consecutive and form an arithmetic sequence; uniform distribution of N2 feature resource blocks in the second feature resource block set means that the indices of the N2 feature resource blocks in the second feature resource block set are not consecutive and form an arithmetic sequence.

[0026] Therefore, compared to the method of selecting adjacent feature resource blocks in a concentrated manner, uniform distribution makes the feature types analyzed within a given timeframe more dispersed in the global feature space. This allows for basic situational awareness of various information features even when only a portion of the feature resource blocks are allocated for analysis, avoiding large-scale feature blind spots. Within the framework of transition detection, uniform selection enhances the coverage representativeness of a single analysis, complementing the transition detection mechanism.

[0027] Optionally, in the first feature resource block set, two adjacent feature resource blocks are correlated, and the p-th feature resource block in the first feature resource block set is a feature resource block that was not analyzed at the first time and is adjacent to the i-th feature resource block. The method further includes: estimating the result p of the p-th feature resource block at the first time based on the result i and the risk propagation function, wherein the first result includes the result p. In the second feature resource block set, two adjacent feature resource blocks are correlated, and the q-th feature resource block in the second feature resource block set is a feature resource block that was not analyzed at the second time and is adjacent to the j-th feature resource block. The method further includes: estimating the result q of the q-th feature resource block at the second time based on the result j and the risk propagation function, wherein the second result includes the result q.

[0028] Therefore, by utilizing the pre-defined correlations between adjacent feature resource blocks within a feature resource block set, risk prediction can be performed on unanalyzed feature resource blocks. Once a feature resource block has been analyzed and the results are obtained, these results are transmitted to its neighboring feature resource blocks through a risk propagation function, thereby predicting the potential information security risks of the latter. This allows a focused analysis to not only produce conclusions for the analyzed dimension itself but also extend to related dimensions. When computational power is limited and comprehensive analysis is not possible, this mechanism effectively expands the results of a single detection, enabling comprehensive analysis results even for transition detection.

[0029] Optionally, the result i, the risk propagation function, and the result p satisfy the following relationship:

[0030] Risk_p=Risk_p_old+f(Risk_i*Corr_i,p);

[0031] Where Risk_p is the result p, Risk_p_old is the historical analysis result of the information feature of the corresponding type p, the corresponding type p is the type of information feature contained in the p-th feature resource, f() is the risk propagation function, Risk_i is the result i, and Corr_i,p is the correlation strength between the p-th feature resource block and the i-th feature resource block.

[0032] The result j, the risk propagation function, and the result q satisfy the following relationship:

[0033] Risk_q=Risk_q_old+f(Risk_j*Corr_j,q);

[0034] Where Risk_q is the result q, Risk_q_old is the historical analysis result of the information feature of the corresponding type q, the corresponding type q is the type of information feature contained in the qth feature resource, f() is the risk propagation function, Risk_j is the result j, and Corr_j,q is the correlation strength between the qth feature resource block and the jth feature resource block.

[0035] Therefore, the quantitative relationship of risk propagation is as follows: the risk prediction value of adjacent feature resource blocks is obtained by superimposing the historical analysis results and the current focused analysis results after correlation weighting. The risk propagation function transforms the input, and the correlation strength determines the propagation weight. This design makes the correlation inference adjustable and flexible, with strongly correlated dimensions receiving higher risk increments and weakly correlated dimensions having less impact. The participation of historical analysis results also gives the risk prediction a smoothing effect over time, avoiding misjudgments caused by single, occasional fluctuations.

[0036] Optionally, the first feature resource block set and the second feature resource block set respectively include the following types of information features: traffic packet length distribution features, flow time interval features, traffic burst pattern features, session hold duration features, heartbeat signal periodic features, ciphertext randomness statistical features, or integrity check anomaly frequency features.

[0037] In a second aspect, an electronic device is provided, including a memory and a processor, wherein the memory is used to store a computer program and the processor is used to execute the computer program to implement the method of the first aspect.

[0038] The objectives and other advantages of this invention can be realized and obtained through the following description. Attached Figure Description

[0039] To make the objectives, technical solutions, and advantages of the present invention clearer, the preferred embodiments of the present invention will be described in detail below with reference to the accompanying drawings, wherein:

[0040] Figure 1 A schematic diagram of the architecture of an information security analysis system provided by the present invention;

[0041] Figure 2 A flowchart of an information security analysis method for cloud-terminal interaction provided by the present invention;

[0042] Figure 3 This is a schematic diagram of the structure of an electronic device provided by the present invention. Detailed Implementation

[0043] The following specific examples illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of the present invention. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other. The accompanying drawings are for illustrative purposes only, representing only schematic diagrams and not actual physical objects, and should not be construed as limiting the present invention. To better illustrate the embodiments of the present invention, some parts in the drawings may be omitted, enlarged, or reduced, and do not represent the actual product form.

[0044] like Figure 1 The diagram shown illustrates the architecture of an information security analysis system provided in this application embodiment. The system includes a terminal, a cloud, and an analysis resource scheduler.

[0045] In this context, "terminal" refers to a user-side device that interacts with the cloud. Specifically, a terminal can be a smartphone, tablet, laptop, desktop computer, IoT terminal device, industrial control terminal, vehicle-mounted terminal, or other electronic device with network communication capabilities. The terminal runs client programs or system services used to initiate business requests to the cloud, upload data, or receive instructions and content from the cloud. In this embodiment, the terminal generates interaction information during its interaction with the cloud. This interaction information is used to extract a global information feature set, serving as the data foundation for subsequent information security analysis.

[0046] The cloud refers to a server-side system or platform that provides computing, storage, and networking resources to terminals via a wide area network (WAN) or local area network (LAN). In specific implementations, the cloud can be at least one of public cloud, private cloud, hybrid cloud, or edge cloud, and its physical form includes, but is not limited to, cloud servers, virtual hosts, container instances, or server clusters. While providing services to terminals, the cloud also generates bidirectional interactive information with the terminals; this interactive information is also used to extract global information feature sets. It is understood that in the embodiments of this application, the interactive information can be obtained solely from the terminal side, solely from the cloud side, or simultaneously from both the terminal side and the cloud side; this application does not impose specific limitations on this.

[0047] The analysis resource scheduler is the core scheduling unit for executing the information security analysis method provided in this application. Physically, the analysis resource scheduler can be deployed inside a terminal as a security analysis module or process within the terminal system; it can also be deployed in the cloud as a component of cloud security services; or it can be deployed in a standalone network device, such as a bypass-access security analysis gateway or network probe device. Logically, the analysis resource scheduler has at least the following capabilities: acquiring a global information feature set from the interaction between the cloud and the terminal; dividing the global information feature set into a feature resource block set consisting of multiple feature resource blocks; and, within consecutive analysis periods, centrally allocating the total analysis computing power budget to a portion of the feature resource blocks in the feature resource block set for analysis, and outputting the analysis results. Here, the analysis computing power budget refers to the maximum amount of computing resources that the analysis resource scheduler can allocate within the current analysis period, and its unit of measurement can be floating-point operations or equivalent computation time, etc.

[0048] When executing analysis, the analysis resource scheduler can invoke one or more detection models. A detection model is a pre-trained or rule-configured algorithmic unit used for security analysis of specific types of information features. The implementation of a detection model can be a neural network model, a statistical testing model, a rule matching engine, or a combination thereof. Each feature resource block can correspond to one or more detection models. After allocating the analysis computing power budget to a feature resource block, the analysis resource scheduler triggers the corresponding detection model and constrains the detection model to complete the analysis task within the allocated analysis computing power budget.

[0049] The information security analysis method provided in this application will be described in detail below with reference to specific embodiments.

[0050] like Figure 2 As shown in the figure, this application provides an information security analysis method for cloud-terminal interaction, which is applied to the system described in the above embodiment.

[0051] The specific process of this method is as follows:

[0052] S201, the resource scheduler obtains a first global information feature set of information about the interaction between the cloud and the terminal in the first time period, and a second global information feature set of information about the interaction between the cloud and the terminal in the second time period adjacent to the first time period.

[0053] In this context, "first time" and "second time" refer to two adjacent time windows. In specific implementations, "first time" and "second time" can be the time periods corresponding to two adjacent detection cycles when the analysis resource scheduler performs periodic security detection tasks. For example, if the analysis resource scheduler is configured to perform information security analysis every 30 seconds, then "first time" can be the current 30-second window, and "second time" can be the next 30-second window immediately following it. "First time" and "second time" can also be two consecutive sliding time windows, for example, each window being 10 seconds long, with a sliding step equal to the window length. "First time" and "second time" can also be triggered by events, such as when the accumulated amount of interactive data between the cloud and the terminal reaches a preset threshold, the current accumulated period is taken as "first time," and the next accumulated period as "second time." Regardless of whether it is based on timing, sliding windows, or event triggering, "first time" and "second time" are temporally adjacent and do not overlap.

[0054] The information exchanged between the cloud and the terminal in the first instance refers to all or part of the data packets, signaling messages, connection records, or session logs transmitted bidirectionally between the cloud and the terminal within that time window. The specific scope and granularity of the acquired interactive information can be determined based on the deployment location and configuration strategy of the analytics resource scheduler. For example, when the analytics resource scheduler is deployed on the terminal side, it can acquire all network data packets sent and received by the terminal within that time window; when the analytics resource scheduler is deployed in the cloud, it can acquire all server logs and traffic mirroring data related to the terminal on the cloud server within that time window; when the analytics resource scheduler is deployed on a separate bypass network device, it can acquire bidirectional traffic copies on the link between the cloud and the terminal through port mirroring or optical splitting.

[0055] The first global information feature set refers to a feature set encompassing multiple information feature types and dimensions, obtained by extracting features from the information exchanged between the cloud and the terminal in the first time. Unlike one-off event-type features in existing technologies that rely on the session establishment phase, this application embodiment prioritizes streaming behavior features that can be continuously observed and extracted within any time window. These features are not isolated from each other but are inherently related: an attack often leaves traces on multiple feature dimensions simultaneously. Based on this, the information feature types contained in the first global information feature set are organized into three adjacent and related feature groups. These three feature groups form a continuous association chain from transmission behavior and connection behavior to encryption protection behavior through the association logic of transition features.

[0056] The first feature group is used to describe the macroscopic transmission behavior pattern of interactive traffic, including traffic packet length distribution characteristics, flow time interval characteristics, and traffic burst pattern characteristics.

[0057] Among them, the packet length distribution characteristic is used to describe the statistical distribution of packet lengths during the interaction process. For example, it can be used to calculate the mean, variance, and quantiles of the lengths of all Transmission Control Protocol (TCP) packets within the first time period, or to construct a packet length distribution histogram. The packet length distribution of normal cloud terminal interactions usually exhibits a specific mixed distribution pattern, such as a combination of a large number of small packets and a small number of large packets. However, when there is a covert tunnel attack, the packet length distribution may tend to be more uniform, that is, a large number of packet lengths are concentrated around a certain fixed value.

[0058] Stream time interval characteristics are used to describe the time interval features between adjacent data packets or adjacent sessions during an interaction. For example, the mean, variance, maximum, and minimum time intervals between adjacent uplink data packets within a first time frame can be calculated, or the autocorrelation function value of the interval sequence can be extracted. Malware's heartbeat communication or timed data return behaviors often exhibit obvious periodicity or regularity in the time interval dimension.

[0059] Traffic burst pattern characteristics are used to describe the bursty distribution of traffic over time during an interaction. For example, the initial time frame can be divided into multiple sub-windows, and the traffic volume within each sub-window can be statistically analyzed to calculate the burst index, the ratio of peak traffic to average traffic, and the distribution of burst duration. Normal interaction traffic bursts are typically random, while data leakage or distributed denial-of-service attacks often exhibit sustained, high-intensity burst patterns.

[0060] The three characteristics mentioned above are strongly correlated: when attackers perform sustained data theft, it often simultaneously triggers shifts in packet length distribution, regular changes in time intervals, and abnormal increases in traffic bursts. These three characteristics corroborate each other, forming a comprehensive observation of traffic transmission behavior. Furthermore, changes in traffic burst patterns are usually related to connection persistence behavior; sustained high burst traffic often relies on long-term session connections.

[0061] The second feature group is used to describe the persistence behavior pattern at the connection layer during the interaction process, including session persistence characteristics and heartbeat signal periodicity characteristics.

[0062] Session duration characteristics describe the distribution of session durations during the interaction process. For example, it can be used to statistically analyze the duration of each Transmission Control Protocol (TCP) connection or TLS session from establishment to closure, extracting the mean, median, and distribution pattern of session durations. Malicious behavior often exhibits extreme distributions in session duration, such as extremely short scanning and probing sessions or extremely long data-stealing sessions.

[0063] The periodicity of heartbeat signals describes the presence and periodicity of regular heartbeat signals during interactions. For example, in long-term connections, the mean and variance of fixed-interval keep-alive messages can be extracted to analyze the degree of jitter. Normal business heartbeats often exhibit some random jitter, while the command and control communication heartbeats of malware typically show highly precise periodicity with minimal jitter.

[0064] There is a strong correlation between the two characteristics mentioned above: regular heartbeats are usually carried over long sessions, and abnormal extensions in session duration are often accompanied by abnormal stability in the heartbeat cycle. At the same time, abnormally long sessions or regular heartbeats mean continuous transmission of encrypted payloads, providing sufficient observation samples for ciphertext randomness analysis. This creates a natural correlation between the characteristics of the connection behavior layer and the characteristics of the encryption protection layer.

[0065] The third feature group is used to describe abnormal signs at the encryption and integrity protection level during the interaction process, including statistical features of ciphertext randomness and frequency features of integrity verification anomalies.

[0066] Among them, the ciphertext randomness statistical characteristics are used to describe the randomness quality of the encrypted payload during the interaction process. For example, statistical randomness tests such as frequency testing, run-length testing, or intra-block frequency testing can be performed on the encrypted payload in the first time period, and the test statistics or p-values ​​can be extracted as features. Ciphertext generated by normal encryption algorithms should be close to a truly random sequence, while maliciously constructed encryption tunnels or improper implementation of encryption algorithms may lead to non-random patterns in the ciphertext, such as consecutive zero-byte blocks or obvious periodic patterns.

[0067] Integrity verification anomaly frequency characteristics are used to describe the frequency and distribution of integrity verification failures during the interaction process. For example, it can count the number of times message authentication code verification fails within the first time period, and the number of times sequence numbers are discontinuous or repeated. When attackers attempt to inject unauthorized messages or replay historical messages, it often leads to a significant increase in the frequency of integrity verification anomalies.

[0068] There is a strong correlation between the two characteristics mentioned above: when an attacker injects unauthorized messages, not only will integrity verification fail, but the randomness of the ciphertext may also become abnormal because the encryption algorithm of the unauthorized messages differs from that of the normal communicator. These two characteristics corroborate each other at the encryption protection level.

[0069] The first global information feature set can be obtained either by the analysis resource scheduler itself performing feature extraction, or by a collection agent on the terminal or cloud performing feature extraction and then reporting the feature set to the analysis resource scheduler. When the analysis resource scheduler performs extraction itself, it first acquires the raw data from the interaction between the cloud and the terminal, then calls the corresponding feature extraction algorithm for each preset information feature type, and finally summarizes all extracted feature values ​​into the first global information feature set. When the collection agent performs extraction, a lightweight collection program is pre-deployed on the terminal or cloud. This program automatically extracts various features at the end of the first time period and sends the feature values ​​to the analysis resource scheduler through a secure channel.

[0070] The second global information feature set refers to the feature set obtained after extracting features from the information interacting between the cloud and the terminal in the second time period. The types of information features contained in the second global information feature set are the same as those contained in the first global information feature set, that is, they also include all the information features in the first, second, and third feature groups mentioned above. The difference between the two lies in the time window of the data source, so the specific feature values ​​may differ due to changes in the interaction behavior.

[0071] The resource scheduler obtains the second global information feature set in the same way as it obtains the first global information feature set. To maintain the comparability of features across the time dimension, the first and second global information feature sets should use the same feature extraction configuration parameters, such as the same statistical window granularity, the same number of bins, and the same randomness test parameters.

[0072] Using the above method, the resource scheduler obtained a complete feature profile of cloud-terminal interactions within two adjacent time windows. These features are organized into three feature groups, with strong correlations between features within each group and continuous correlation chains between groups formed through the association logic of transitional features. This provides a data foundation for subsequently dividing the global information feature set into feature resource blocks and for risk inference using the correlation of adjacent feature resource blocks at different analysis times.

[0073] S202, the resource scheduler analyzes and divides the first global information feature set into a first feature resource block set consisting of multiple feature resource blocks, and divides the second global information feature set into a second feature resource block set consisting of multiple feature resource blocks.

[0074] In this context, a feature resource block is the smallest set of information features that can be independently allocated analytical computing power, and the feature resource blocks obtained from two partitions contain information features of the same type. The smallest set of information features that can be independently allocated analytical computing power means that when the analytical resource scheduler allocates the total analytical computing power budget to each feature resource block, it does so on a per-feature-resource-block basis. Specifically, for each feature resource block, the analytical resource scheduler allocates an independent share of the analytical computing power budget and triggers the corresponding detection model, performing analysis on all information features contained in that feature resource block based on the allocated computing power budget. A feature resource block cannot be further divided into smaller units of computing power allocation. A feature resource block can contain one type of information feature or multiple information features; when it contains multiple information features, these features are treated as a whole in terms of computing power allocation. For example, if a feature resource block contains two information features: traffic packet length distribution feature and flow time interval feature, then after the analysis resource scheduler allocates an analysis computing power budget to the feature resource block, it triggers the corresponding detection model to analyze both information features simultaneously based on the computing power budget, instead of allocating computing power separately for the traffic packet length distribution feature and the flow time interval feature.

[0075] In practical implementation, the mapping relationship between the information features contained in the first global information feature set and the feature resource blocks can be pre-configured. The analysis resource scheduler, based on this mapping relationship, divides the information features in the first global information feature set into corresponding feature resource blocks, thus forming a first feature resource block set composed of multiple feature resource blocks. For example, the mapping relationship can be configured such that each feature resource block corresponds to one type of information feature; therefore, when the first global information feature set contains M types of information features, the first feature resource block set contains M feature resource blocks. Alternatively, the mapping relationship can be configured such that multiple strongly correlated information features within a feature group are assigned to the same feature resource block; in this case, the number of feature resource blocks in the first feature resource block set is less than the total number of information feature types. Regardless of the mapping granularity used, the first feature resource block set and the second feature resource block set use the same mapping configuration, thereby ensuring that the types of information features contained in the feature resource blocks obtained from the two divisions are the same.

[0076] There is a correlation between two adjacent feature resource blocks in the first feature resource block set, and a correlation between two adjacent feature resource blocks in the second feature resource block set. Here, "adjacent" refers to two feature resource blocks with adjacent sequence numbers after partitioning. "Correlation" means that, in real-world attack scenarios, the information features contained in adjacent feature resource blocks tend to be triggered simultaneously by the same attack behavior. This correlation can be determined by the feature group to which the feature belongs, or it can be derived from statistical analysis of historical attack events.

[0077] Specifically, in this embodiment, the first feature resource block set and the second feature resource block set respectively include the following types of information features: traffic packet length distribution features, flow time interval features, traffic burst pattern features, session hold duration features, heartbeat signal periodicity features, ciphertext randomness statistical features, or integrity check anomaly frequency features. For example, after partitioning, the first feature resource block in the first feature resource block set includes traffic packet length distribution features, the second feature resource block includes flow time interval features, the third feature resource block includes traffic burst pattern features, the fourth feature resource block includes session hold duration features, the fifth feature resource block includes heartbeat signal periodicity features, the sixth feature resource block includes ciphertext randomness statistical features, and the seventh feature resource block includes integrity check anomaly frequency features; these seven feature resource blocks are sequentially adjacent.

[0078] Under the above classification method, the correlation between adjacent feature resource blocks is reflected as follows: The first and second feature resource blocks belong to the same first feature group. The packet length distribution and flow time interval jointly characterize the micro-behavior of the traffic. When an attacker establishes a covert tunnel to continuously transmit data, the packet length distribution tends to become uniform and the time interval tends to become regular, often occurring simultaneously. The second and third feature resource blocks belong to the same first feature group. The regular changes in the time interval directly affect the traffic burst pattern after accumulating over time. The third and fourth feature resource blocks belong to the first and second feature groups, respectively. Continuous high burst traffic requires long-term session connections to carry it. Both of them are affected by attacks. There is a causal relationship in the attack scenario; the fourth and fifth feature resource blocks belong to the second feature group, and regular heartbeats are usually carried on long sessions. The abnormal extension of session duration and the abnormal stability of the heartbeat cycle occur together; the fifth and sixth feature resource blocks belong to the second and third feature groups respectively. The continuous encryption payload provided by regular heartbeats provides sufficient samples for the analysis of ciphertext randomness. The periodic anomaly of the heartbeat is associated with the decrease in ciphertext randomness; the sixth and seventh feature resource blocks belong to the third feature group. The unauthorized messages injected by the attacker simultaneously destroy the ciphertext randomness and integrity verification. The two mutually confirm each other at the encryption protection level.

[0079] It is understood that the above division method is only an example. In practical applications, the types and quantities of information features contained in each feature resource block can be adjusted according to security detection requirements, as long as the correlation based on the attack behavior logic exists between adjacent feature resource blocks.

[0080] The partitioning method for the second feature resource block set is the same as that for the first feature resource block set. Specifically, the number of feature resource blocks in the second feature resource block set, the types of information features contained in each feature resource block, and the order of the feature resource blocks are all consistent with the first feature resource block set. This ensures that the analysis results are comparable in terms of feature dimensions when analyzing the two feature resource block sets at the first and second time points, respectively. It also ensures that the inference logic for risk inference based on the correlation of adjacent feature resource blocks is consistent across the two feature resource block sets.

[0081] S203, the analysis resource scheduler allocates the total analysis computing power budget to the first part of the feature resource blocks corresponding to the first feature resource block set at a first time to perform analysis and obtain a first result; and at a second time, it allocates the total analysis computing power budget to the second part of the feature resource blocks corresponding to the second feature resource block set to perform analysis and obtain a second result.

[0082] In this context, the first timing point refers to the analysis execution time corresponding to the first time window, and the second timing point refers to the analysis execution time corresponding to the second time window. In specific implementations, the first timing point can be the start time of the next analysis cycle after the end of the first time window, and the second timing point can be the start time of the next analysis cycle after the end of the second time window. For example, if the first time window is the first 30-second window, then the first timing point could be the analysis cycle starting at the 31st second; if the second time window is the second 30-second window, then the second timing point could be the analysis cycle starting at the 61st second. The first and second timing points are sequentially adjacent, meaning the second timing point immediately follows the first timing point.

[0083] The feature resource blocks analyzed in the first analysis session and the feature resource blocks analyzed in the second analysis session contain different types of information features. This means that the analysis resource scheduler will not repeatedly focus on the exact same type of information feature in two adjacent analysis sessions, but will intentionally switch the analysis focus between different feature types. For example, if the first analysis session analyzes the characteristics of traffic packet length distribution and traffic burst pattern, the second analysis session can analyze the characteristics of flow time interval and the periodicity of heartbeat signals. The feature types covered by the two analyses will at least have some differences. This design ensures that after multiple analysis sessions have accumulated, the analysis resources can cover all feature types, avoiding certain feature types from always being in the analysis blind spot.

[0084] The first and second results are used together to indicate whether there are information security risks in the interaction between the cloud and the terminal. Since the first result only reflects the risk status of some characteristic resource blocks analyzed at the first time point, and the second result only reflects the risk status of some characteristic resource blocks analyzed at the second time point, neither is complete on its own. By combining the two, the resource scheduler can obtain a more comprehensive judgment on the security status across multiple characteristic dimensions through cumulative analysis of two adjacent time points, thereby making a more accurate final decision on whether a risk exists.

[0085] 1) The first part of the feature resource blocks contains N1 feature resource blocks. The i-th feature resource block is the i-th of the N1 feature resource blocks, where i iterates from 1 to N1, and N1 is an integer greater than 1. The specific value of N1 can be determined based on the total analysis computing power budget and the desired detection depth. For example, when the total analysis computing power budget is relatively abundant, N1 can be taken as a larger value to expand the feature coverage of a single analysis; when the total analysis computing power budget is relatively tight, N1 can be taken as a smaller value to ensure that each analyzed feature resource block obtains sufficient computing power density.

[0086] In this set, N1 feature resource blocks are evenly distributed within the first feature resource block set. Specifically, "evenly distributed within the first feature resource block set" means that the N1 feature resource blocks are not consecutively numbered and form an arithmetic sequence. For example, if the first feature resource block set contains 7 feature resource blocks, numbered 1 to 7, with N1 being 3 and the common difference of the arithmetic sequence being 2, then the selected 3 feature resource blocks could be numbered 1, 3, and 5, or 2, 4, and 6. The advantage of this selection method is that it avoids selecting adjacent feature resource blocks in a concentrated manner within the feature resource block sequence, ensuring that the analyzed feature types are as dispersed as possible throughout the feature space. This allows for basic situational awareness of the entire feature space within a limited set of N1 analyzed objects. Furthermore, since there is an adjacency relationship between unselected and selected feature resource blocks, risk inference can be performed on unanalyzed feature resource blocks using adjacency correlation, thereby indirectly expanding the analysis coverage.

[0087] At the first opportune moment, the analysis resource scheduler allocates the total analysis computing power budget to the i-th feature resource block according to the feature width and the weight corresponding to the i-th feature resource block, and triggers the detection model corresponding to the i-th feature resource block. Based on the allocated analysis computing power budget, the i-th feature resource block is analyzed to obtain the result i corresponding to the i-th feature resource block in the first result.

[0088] The analysis computing power budget allocated to the i-th feature resource block satisfies the following relationship:

[0089] P(i,1)=P_total×(w_i / w_total1)×α_i;

[0090] In the formula, P(i,1) is the analysis computing power budget allocated to the i-th feature resource block, and its unit of measurement is consistent with P_total.

[0091] P_total represents the total analytics computing power budget, which refers to the maximum amount of analytics computing power that the analytics resource scheduler can allocate within a single analytics session. In practical implementations, the total analytics computing power budget can be measured in total floating-point operations (Floating-point operations). Floating-point operations refer to the total number of floating-point operations performed by a computer when executing a computational task, and are commonly used to measure the computational workload of a task. For example, when the analytics resource scheduler is deployed on the terminal side, P_total can be set to, for example, 500 million floating-point operations, based on the maximum number of floating-point operations that the terminal's CPU can allocate to security analytics tasks within a single analytics session. When the analytics resource scheduler is deployed in the cloud, P_total can be set to, for example, 10 billion floating-point operations, based on the computing power limit of the containers or virtual machines allocated to the security analytics tasks on that terminal. The total analytics computing power budget can also be measured in equivalent computation time, which refers to the time required to execute a unit of computation on a specific hardware platform, such as the average time required to process one million floating-point operations on a specified CPU model.

[0092] w_i represents the feature width of the i-th feature resource block. The feature width refers to the number of floating-point operations required to complete a baseline detection of all information features contained in the i-th feature resource block. Here, baseline detection refers to the number of floating-point operations required to perform a complete inference on the input data using the detection model corresponding to the feature resource block, under a standard configuration that meets the minimum detection sensitivity requirements. The feature width is determined through offline calibration of the detection model, rather than being dynamically measured during each detection. Specifically, during system initialization or before the detection model is deployed, a set of standard test data can be input into the detection model, and the total number of floating-point operations performed by the detection model to complete a complete inference under the baseline configuration can be recorded. This value is then calibrated as the feature width of its corresponding feature resource block. For example, for a lightweight neural network model used to analyze the distribution characteristics of traffic packet lengths, in the baseline configuration, the network has 3 layers with 64 neurons per layer. The input data is the packet length distribution histogram vector statistically analyzed within a time window. Offline calibration of this model shows that approximately 20 million floating-point operations are required to complete one inference operation. Therefore, the feature width w_i of this feature resource block is 20 million floating-point operations. If a feature resource block contains multiple information features, and its corresponding detection model is a multi-task joint model, then the feature width of this feature resource block is the number of floating-point operations required for the multi-task joint model to complete one joint inference operation in the baseline configuration. The feature width of different feature resource blocks can vary, depending on the complexity of their corresponding detection models and the scale of the input data.

[0093] w_total1 is the total feature width of the first part of the feature resource blocks, which is the sum of the feature widths of all N1 feature resource blocks in the first part of the feature resource blocks, i.e., w_total1 = Σw_i (i iterates from 1 to N1). For example, if N1 = 3, and the feature widths of the three feature resource blocks are 20 million, 30 million, and 30 million floating-point operations respectively, then w_total1 = 80 million floating-point operations.

[0094] α_i represents the weight of the i-th feature resource block. The weight is an adjustable coefficient used to reflect the differentiated emphasis on different feature resource blocks in the total computing power allocation. Weights can have default values; for example, all weights can default to 1.0, in which case the computing power allocation is determined solely by the basic proportion of the feature width, meaning each feature resource block receives computing power proportional to its feature width. Weights can also be dynamically adjusted based on the security analysis strategy. For example, if historical analysis results indicate a high frequency of anomalies in a certain type of information feature, the weight of the corresponding feature resource block can be appropriately increased to receive more computing power; conversely, if a certain type of information feature remains in a normal state for a long period, its weight can be appropriately decreased. The minimum weight can be set to a baseline value greater than 0 to ensure that each selected feature resource block receives at least enough computing power to maintain baseline detection. The specific method for determining the weight will be explained in detail in subsequent steps in conjunction with risk inference.

[0095] Based on the above allocation relationship, the computing power density of the analysis computing power budget allocated to the i-th feature resource block satisfies the following relationship:

[0096] CD_i = P(i,1) / w_i;

[0097] Where CD_i represents the computing power density of the analysis computing power budget allocated to the i-th feature resource block. Computing power density is a dimensionless ratio, indicating that the actual computing power obtained by the feature resource block is a multiple of the computing power required for its baseline detection, used to represent the detection depth for analysis. Combining the aforementioned allocation formula, we can obtain CD_i = (P_total / w_total1) × α_i. It can be seen that after the first part of the feature resource blocks is determined, P_total / w_total1 is a constant, and at this time, the computing power density of each feature resource block is entirely determined by its weight α_i. The larger the weight, the higher the computing power density and the greater the detection depth. For example, if P_total = 500 million floating-point operations and w_total1 = 80 million floating-point operations, then P_total / w_total1 = 6.25. When α_i=1.0, CD_i=6.25, it means that the computing power obtained by this feature resource block is 6.25 times that of its baseline requirement, which can support in-depth analysis far exceeding the baseline; when α_i=0.5, CD_i=3.125, it means that it can still obtain more than 3 times the computing power of the baseline.

[0098] Specifically, the analysis resource scheduler sends the i-th feature resource block and the analysis computing power budget allocated to it to the detection model corresponding to the i-th feature resource block. It then receives the result i returned by the detection model, which is the risk score obtained from the focused analysis of the i-th feature resource block. The result i can be a normalized value, for example, ranging from [0,1], where 0 represents no risk and 1 represents the highest risk. Values ​​closer to 1 indicate higher risk. Typically, if the detection model considers it risk-free, the score can be 0. The detection model corresponding to the i-th feature resource block is configured such that the analysis computing power used to analyze the i-th feature resource block does not exceed the analysis computing power budget allocated to it.

[0099] In practical implementation, the detection model can adhere to the analysis computing power budget constraint in the following ways. One implementation pre-configures multiple inference branches with varying computing power overhead. Different inference branches correspond to different detection depths and accuracies; inference branches with higher computing power overhead typically have higher detection accuracy, but also consume more floating-point operations. For example, the detection model can include one shallow inference branch and one deep inference branch. The shallow inference branch has fewer network layers, requiring approximately 10 million floating-point operations to complete one inference; the deep inference branch has more network layers, requiring approximately 50 million floating-point operations to complete one inference. When the detection model receives the analysis computing power budget information, it compares the budget value with the calibrated computing power overhead of each inference branch and selects the inference branch with the highest detection accuracy and computing power overhead not exceeding the budget to perform the analysis. For example, if the budget is 30 million floating-point operations, the detection model can choose a shallower configuration within the deep inference branch, or choose a shallow inference branch and increase the number of ensemble inferences to improve accuracy, as long as the total computing power does not exceed the budget.

[0100] In another implementation, the detection model continuously tracks the number of floating-point operations used during inference. The model can obtain the current number of floating-point operations consumed in real time by calling a hardware performance counter or a software computing power statistics interface. When the number of floating-point operations used reaches a preset threshold of the analysis computing power budget, the detection model implements an early termination strategy, such as skipping remaining non-critical calculation steps and directly generating the analysis result based on the existing intermediate calculation results. When the number of floating-point operations used reaches the upper limit of the analysis computing power budget, the detection model forcibly terminates the calculation and outputs the existing intermediate result as result i. This ensures that even in complex model scenarios where the precise computing power expenditure cannot be predicted, the computing power used for model analysis does not exceed the budget.

[0101] After obtaining result i, the resource scheduler also uses the correlation between adjacent feature resource blocks in the first feature resource block set to make risk inferences for feature resource blocks that were not directly analyzed in the first time.

[0102] Optionally, the p-th feature resource block in the first feature resource block set is a feature resource block that was not analyzed at the first time and is adjacent to the i-th feature resource block. The method further includes: estimating the result p of the p-th feature resource block at the first time based on the result i and the risk propagation function, wherein the first result includes the result p.

[0103] Among them, the result i, the risk propagation function, and the result p satisfy the following relationship:

[0104] Risk_p=Risk_p_old+f(Risk_i×Corr(i,p));

[0105] In the formula, Risk_p represents the result p, i.e., the risk prediction result for the p-th feature resource block. Risk_p_old represents the historical analysis result of the information feature of the corresponding type p. Here, the corresponding type p refers to the type of information feature contained in the p-th feature resource block. For example, if the p-th feature resource block contains the periodic feature of heartbeat signals, then Risk_p_old is the result obtained from the most recent analysis of the periodic feature of heartbeat signals, or a statistical value among multiple historical analysis results, such as the average of the three most recent analysis results. Introducing historical analysis results can give the risk prediction a smoothing effect over time, avoiding misjudgments caused by single, occasional fluctuations.

[0106] f() is the risk propagation function, used to map the product of the focused analysis results and the correlation strength into a risk increment. The risk propagation function can be a linear function, such as f(x) = β × x, where β is the propagation coefficient, and the value of β can range from 0 to 1; or it can be a nonlinear function, such as an sigmoid function with saturation characteristics, to limit the maximum risk increment of a single propagation and prevent the risk value from growing indefinitely after multiple propagations. The specific form of the risk propagation function can be determined empirically or experimentally.

[0107] Risk_i is the result i.

[0108] Corr(i,p) represents the correlation strength between the p-th feature resource block and the i-th feature resource block. The correlation strength is a pre-defined constant, ranging from [0,1]. The specific value of Corr(i,p) can be determined by the feature group relationship described in S202. For example, if the i-th feature resource block contains a traffic burst pattern feature and the p-th feature resource block contains a session hold duration feature, and both belong to the first and second feature groups respectively, but have a transitional correlation, Corr(i,p) can be 0.7, indicating a medium-to-strong correlation between them. If the i-th feature resource block contains a session hold duration feature and the p-th feature resource block contains a heartbeat signal periodicity feature, and both belong to the second feature group, having a strong correlation, Corr(i,p) can be 0.9.

[0109] The risk propagation process described above can be executed on all (p,i) combinations that meet the conditions within the first timeframe. When an unanalyzed feature resource block is adjacent to multiple analyzed feature resource blocks simultaneously, its risk prediction result can be synthesized after propagating the results of multiple adjacent analyses separately, for example, by taking the maximum value or weighted average of each propagation result.

[0110] 2) The second part, the feature resource blocks, contains N2 feature resource blocks. The j-th feature resource block is the j-th of the N2 feature resource blocks, where j iterates from 1 to N2, and N2 is an integer greater than 1. The value of N2 can be the same as or different from N1. When N2 is the same as N1, the focusing granularity of the two analyses is consistent, facilitating comparison; when N2 is different from N1, the focusing range of the second analysis can be dynamically adjusted based on the results of the first analysis.

[0111] The N2 feature resource blocks are evenly distributed in the second feature resource block set. Specifically, this means that the N2 feature resource blocks in the second feature resource block set are not consecutively numbered but form an arithmetic sequence, and their selection method is similar to that of the first part of the feature resource blocks. Furthermore, the selection of the second part of the feature resource blocks should satisfy the following condition: the types of information features contained in the feature resource blocks analyzed in the second timeframe are at least partially different from those in the feature resource blocks analyzed in the first timeframe. To achieve this, the analysis resource scheduler can select an arithmetic sequence in the second feature resource block set that is different from that in the first part of the feature resource blocks, for example, by selecting different starting numbers or different common differences, to ensure differentiated coverage of feature types. For example, if the first feature resource block set contains feature resource blocks numbered 1 to 7, and the numbers of the first part of the feature resource blocks are 1, 3, and 5, then the numbers of the second part of the feature resource blocks can be 2, 4, and 6. In this way, the feature types covered by the two analyses are completely complementary, and all 7 feature types are traversed within two adjacent timeframes.

[0112] In the second instance, the analysis resource scheduler allocates the total analysis computing power budget to the j-th feature resource block according to the feature width and the weight corresponding to the j-th feature resource block, and triggers the detection model corresponding to the j-th feature resource block. Based on the allocated analysis computing power budget, the j-th feature resource block is analyzed to obtain the result j corresponding to the j-th feature resource block in the second result.

[0113] The analysis computing budget allocated to the j-th feature resource block satisfies the following relationship:

[0114] P(j,2)=P_total×(w_j / w_total2)×α_j;

[0115] In the formula, P(j,2) is the analysis computing power budget allocated to the j-th feature resource block, and P_total is the total analysis computing power budget, with the same meaning as in the first scenario. w_j is the feature width of the j-th feature resource block, with the same meaning and calibration method as w_i. w_total2 is the total feature width of the second part of the feature resource blocks, i.e., w_total2=Σw_j (j traverses from 1 to N2). α_j is the weight corresponding to the j-th feature resource block.

[0116] Therefore, the computing power density of the analysis computing power budget allocated to the j-th feature resource block satisfies the following relationship:

[0117] CD_j=P(j,2) / w_j;

[0118] Where CD_j is the computing power density of the analysis computing power budget allocated to the j-th feature resource block, and its meaning is the same as the computing power density of the first timing.

[0119] Specifically, the analysis resource scheduler sends the j-th feature resource block and information indicating the allocated analysis computing power budget to the detection model corresponding to the j-th feature resource block, thereby receiving the result j returned by the detection model corresponding to the j-th feature resource block. The detection model corresponding to the j-th feature resource block is configured such that the analysis computing power used to analyze the j-th feature resource block does not exceed the allocated analysis computing power budget for the j-th feature resource block. The implementation method of the detection model complying with the computing power budget constraint is the same as that of the detection model corresponding to the ith feature resource block, that is, it can be achieved by pre-setting multiple inference branches for selective execution, or by calculating the computing power overhead in real time during the inference process and terminating early.

[0120] After obtaining result j, the resource scheduler also uses the correlation between adjacent feature resource blocks in the second feature resource block set to make risk inferences for feature resource blocks that were not directly analyzed in the second time.

[0121] Optionally, the q-th feature resource block in the second feature resource block set is a feature resource block that was not analyzed at the second time and is adjacent to the j-th feature resource block. The method further includes: estimating the result q of the q-th feature resource block at the second time based on the result j and the risk propagation function, wherein the second result includes the result q.

[0122] Wherein, the result j, the risk propagation function, and the result q satisfy the following relationship:

[0123] Risk_q=Risk_q_old+f(Risk_j×Corr(j,q));

[0124] In the formula, Risk_q is the result q, Risk_q_old is the historical analysis result of the information feature of the corresponding type q, and the corresponding type q is the type of information feature contained in the q-th feature resource block. f() is the risk propagation function, Risk_j is the result j, and Corr(j,q) is the correlation strength between the q-th feature resource block and the j-th feature resource block. The meaning and value of each parameter are the same as those described in the first timing section.

[0125] It should be noted that the weights α_i in the first timeframe and α_j in the second timeframe can be dynamically adjusted based on the risk inference results. For example, in the first timeframe, if the risk propagation function predicts that a certain unanalyzed p-th feature resource block has a high risk, the analysis resource scheduler can include the feature type corresponding to the p-th feature resource block in the second part of the feature resource blocks when determining the second part of the feature resource blocks in the second timeframe, or increase the weight α_j of the corresponding feature resource block, so that a higher computing power density is allocated to the feature resource block for in-depth confirmation in the second timeframe. This feedback adjustment of subsequent analysis scheduling based on risk inference results realizes an upgrade of the analysis strategy from passive polling to proactive containment.

[0126] By employing the above method, the resource scheduler performs focused computational analysis on different feature resource blocks in two adjacent analysis sessions. It then uses the correlation between adjacent feature resource blocks to infer risks in unanalyzed feature resource blocks, ultimately yielding a first result and a second result. These two results are used together to indicate whether there are information security risks in cloud-terminal interactions. This approach achieves both full feature space coverage and sufficient detection depth within a limited total analysis computing budget.

[0127] It should be noted that in the embodiments of this application, the detection model corresponding to each feature resource block can be implemented using existing machine learning models or statistical detection models. This application does not limit the specific type and training method of the detection model.

[0128] For example, for feature resource blocks containing traffic packet length distribution characteristics or flow time interval characteristics, the corresponding detection model can adopt an anomaly detection model based on an autoencoder. The training process of this model is roughly as follows: collect a large amount of historical traffic data between the cloud and the terminal under normal interaction conditions, and extract the corresponding packet length distribution feature vector or time interval feature vector as training samples; input the training samples into the autoencoder network, with the goal of minimizing the reconstruction error, and update the network parameters through the backpropagation algorithm, so that the autoencoder learns a low-dimensional representation of normal traffic features. In the inference phase, when the reconstruction error between the input feature vector and the reconstruction vector exceeds a preset threshold, it is determined that there is an anomaly risk in that feature dimension, and a normalized risk score is output according to the magnitude of the error.

[0129] For example, for a feature resource block containing statistical characteristics of randomness in encrypted text, the corresponding detection model can adopt a statistical hypothesis testing model, such as standard randomness testing methods like frequency test, run test, or intra-block frequency test, to quantitatively evaluate the randomness quality of the encrypted payload and output a risk score based on the significance level corresponding to the test statistic.

[0130] For example, for a feature resource block containing the frequency of integrity verification anomalies, the corresponding detection model can adopt a threshold-based rule matching model, which compares the statistically obtained number of verification failures or sequence number anomalies with a preset normal behavior baseline threshold, and outputs a risk score based on the magnitude of exceeding the threshold.

[0131] The training or configuration of the aforementioned detection model can be completed offline before the analysis resource scheduler is deployed. After training, the model parameters or rules are embedded into the analysis resource scheduler. During the operation of the analysis resource scheduler, the detection model receives the analysis computing power budget allocated by the analysis resource scheduler and completes inference within the budget constraints according to the aforementioned multi-inference branch selection or early termination mechanism.

[0132] In summary, this scheme concentrates the total analysis computing power budget on different parts of the first and second feature resource block sets at two adjacent analysis times, instead of traversing all feature resource blocks at each time. This allows the computing power at each analysis time to focus on specific information feature types, improving the detection depth of the analyzed features without increasing the total computing power overhead. Furthermore, since the feature types analyzed at adjacent times are at least partially different, multiple times can still cover all feature types, thus achieving a balance between cost and detection accuracy.

[0133] Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Exemplarily, the electronic device may be a terminal, or a chip (system) or other component or assembly that can be disposed in the terminal. Figure 3 As shown, the electronic device 200 may include a processor 201. Optionally, the electronic device 200 may also include a memory 202 and / or a transceiver 203. The processor 201 is coupled to the memory 202 and the transceiver 203, for example, via a communication bus.

[0134] The following is combined with Figure 3 A detailed description of each component of the electronic device 200 is provided below:

[0135] The processor 201 is the control center of the electronic device 200. It can be a single processor or a collective term for multiple processing elements. For example, the processor 201 can be one or more central processing units (CPUs), application-specific integrated circuits (ASICs), or one or more integrated circuits configured to implement the embodiments of this application, such as one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs).

[0136] Optionally, the processor 201 can perform various functions of the electronic device 200 by running or executing software programs stored in the memory 202 and calling data stored in the memory 202, such as performing the aforementioned functions. Figure 2 The method shown.

[0137] In a specific implementation, as one example, the processor 201 may include one or more CPUs, for example... Figure 3 CPU0 and CPU1 are shown in the diagram.

[0138] In a specific implementation, as one example, the electronic device 200 may also include multiple processors, for example... Figure 3 The processor 201 shown is an example. Each of the processors 201 can be a single-core processor or a multi-core processor. Here, "processor" can refer to one or more devices, circuits, and / or processing cores used to process data (e.g., computer program instructions).

[0139] The memory 202 is used to store the software program that executes the solution of this application, and the processor 201 controls its execution. The specific implementation method can be referred to the above method embodiment, and will not be repeated here.

[0140] Optionally, the memory 202 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. The memory 202 may be integrated with the processor 201 or exist independently, and may be accessed through the interface circuit of the electronic device 200. Figure 3 (Not shown in the image) is coupled to processor 201, but this embodiment does not specifically limit this.

[0141] Transceiver 203 is used for communication with other electronic devices. For example, if electronic device 200 is a terminal, transceiver 203 can be used to communicate with a network device or with another terminal device. As another example, if electronic device 200 is a network device, transceiver 203 can be used to communicate with a terminal or with another network device.

[0142] Optionally, transceiver 203 may include a receiver and a transmitter. Figure 3 (Not shown separately). The receiver is used to implement the receiving function, and the transmitter is used to implement the transmitting function.

[0143] Optionally, the transceiver 203 can be integrated with the processor 201, or it can exist independently and be connected via the interface circuit of the electronic device 200. Figure 3 (Not shown in the image) is coupled to processor 201, but this embodiment does not specifically limit this.

[0144] Understandable Figure 3 The structure of the electronic device 200 shown does not constitute a limitation on the electronic device. Actual electronic devices may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0145] Furthermore, the technical effects of the electronic device 200 can be referred to the technical effects of the methods described in the above-described method embodiments, and will not be repeated here.

[0146] It should be understood that the processor in the embodiments of this application can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc.

[0147] It should also be understood that the memory in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous DRAM (DDR SDRAM), enhanced synchronous DRAM (ESDRAM), synchronous linked DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0148] The above embodiments can be implemented, in whole or in part, by software, hardware (such as circuits), firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0149] It should be understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. A and B can be singular or plural. Additionally, the character " / " in this article generally indicates an "or" relationship between the preceding and following related objects, but it can also represent an "and / or" relationship. Please refer to the context for a more accurate understanding.

[0150] In this application, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or multiple items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0151] It should be understood that in the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0152] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0153] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0154] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0155] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0156] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0157] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0158] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A method for information security analysis of cloud-terminal interaction, characterized in that, The method is applied to the analysis of a resource scheduler, and the method includes: A first global information feature set is obtained to acquire information about the interaction between the cloud and the terminal in a first time period, and a second global information feature set is obtained to acquire information about the interaction between the cloud and the terminal in a second time period adjacent to the first time period; The first global information feature set is divided into a first feature resource block set consisting of multiple feature resource blocks, and the second global information feature set is divided into a second feature resource block set consisting of multiple feature resource blocks; each feature resource block is the smallest set of information features that can be independently allocated analytical computing power, and the types of information features contained in the feature resource blocks obtained by the two divisions are the same. At a first opportune moment, the total analytical computing budget is allocated to the first part of the feature resource blocks corresponding to the first feature resource block set for analysis, resulting in a first result; and at a second opportune moment, the total analytical computing budget is allocated to the second part of the feature resource blocks corresponding to the second feature resource block set for analysis, resulting in a second result; the feature resource blocks analyzed at the first opportune moment and the feature resource blocks analyzed at the second opportune moment contain different types of information features, and the first result and the second result are used to jointly indicate whether there is an information security risk in the interaction between the cloud and the terminal.

2. The method according to claim 1, characterized in that, The first part of the feature resource blocks contains N1 feature resource blocks, where the i-th feature resource block is the i-th of the N1 feature resource blocks, i iterates from 1 to N1, and N1 is an integer greater than 1. The first step involves allocating the total analysis computing power budget to the first part of the feature resource blocks corresponding to the first feature resource block set for analysis, obtaining a first result, including: At the first timing, based on the feature width of the i-th feature resource block and the weight corresponding to the i-th feature resource block, the total analysis computing power budget is allocated to the i-th feature resource block, and the detection model corresponding to the i-th feature resource block is triggered. The i-th feature resource block is analyzed based on the allocated analysis computing power budget to obtain the result i corresponding to the i-th feature resource block in the first result. Furthermore, the second part of the feature resource blocks contains N2 feature resource blocks, where the j-th feature resource block is the j-th of the N2 feature resource blocks, j iterates from 1 to N2, and N2 is an integer greater than 1. In the second instance, the total analysis computing power budget is concentratedly allocated to the second part of the feature resource blocks corresponding to the second feature resource block set for analysis, to obtain a second result, including: At the second timing, based on the feature width of the j-th feature resource block and the weight corresponding to the j-th feature resource block, the total analysis computing power budget is allocated to the j-th feature resource block, and the detection model corresponding to the j-th feature resource block is triggered. The j-th feature resource block is analyzed based on the allocated analysis computing power budget to obtain the result j corresponding to the j-th feature resource block in the second result.

3. The method according to claim 2, characterized in that, The analysis computing power budget allocated to the i-th feature resource block satisfies the following relationship: P(i,1)=P_total*(w_i / w_total1)*α_i; Wherein, P(i,1) is the analysis computing power budget allocated to the i-th feature resource block, P_total is the total analysis computing power budget, w_i is the feature width of the i-th feature resource block, w_total1 is the total feature width of the first part of feature resource blocks, and α_i is the weight corresponding to the i-th feature resource block. The analysis computing power budget allocated to the j-th feature resource block satisfies the following relationship: P(j,2)=P_total*(w_j / w_total2)*α_j; Wherein, P(j,2) is the analysis computing power budget allocated to the j-th feature resource block, P_total is the total analysis computing power budget, w_j is the feature width of the j-th feature resource block, w_total2 is the total feature width of the second part of the feature resource blocks, and α_j is the weight corresponding to the j-th feature resource block.

4. The method according to claim 3, characterized in that, The computing power density of the analysis computing power budget allocated to the i-th feature resource block satisfies the following relationship: CD_i = P(i,1) / w_i; where CD_i is the computing power density of the analysis computing power budget allocated to the i-th feature resource block; The computing power density of the analysis computing power budget allocated to the j-th feature resource block satisfies the following relationship: CD_j=P(j,2) / w_j; where CD_j is the computing power density of the analysis computing power budget allocated to the j-th feature resource block; The computing power density is used to represent the detection depth for analysis.

5. The method according to claim 2, characterized in that, The triggering of the detection model corresponding to the i-th feature resource block, based on the allocated analysis computing power budget, analyzes the i-th feature resource block to obtain the result i corresponding to the i-th feature resource block in the first result, including: Send the i-th feature resource block and information indicating the analysis computing power budget allocated to the i-th feature resource block to the detection model corresponding to the i-th feature resource block, thereby receiving the result i returned by the detection model corresponding to the i-th feature resource block, wherein the detection model corresponding to the i-th feature resource block is configured such that the analysis computing power used to analyze the i-th feature resource block does not exceed the analysis computing power budget allocated to the i-th feature resource block; The detection model corresponding to the j-th feature resource block is triggered, and the j-th feature resource block is analyzed based on the allocated analysis computing power budget to obtain the result j corresponding to the j-th feature resource block in the second result, including: The system sends the j-th feature resource block and information indicating the analysis computing power budget allocated to the j-th feature resource block to the detection model corresponding to the j-th feature resource block, thereby receiving the result j returned by the detection model corresponding to the j-th feature resource block, wherein the detection model corresponding to the j-th feature resource block is configured such that the analysis computing power used to analyze the j-th feature resource block does not exceed the analysis computing power budget allocated to the j-th feature resource block.

6. The method according to any one of claims 2-5, characterized in that, The N1 feature resource blocks are evenly distributed in the first feature resource block set, and the N2 feature resource blocks are evenly distributed in the second feature resource block set.

7. The method according to claim 6, characterized in that, The uniform distribution of the N1 feature resource blocks in the first feature resource block set means that the sequence numbers of the N1 feature resource blocks in the first feature resource block set are not consecutive and form an arithmetic sequence. The uniform distribution of the N2 feature resource blocks in the second feature resource block set means that the sequence numbers of the N2 feature resource blocks in the second feature resource block set are not consecutive and form an arithmetic sequence.

8. The method according to claim 7, characterized in that, The method further includes: Two adjacent feature resource blocks in the first feature resource block set are correlated; the p-th feature resource block in the first feature resource block set is a feature resource block that was not analyzed at the first time and is adjacent to the i-th feature resource block; Based on the result i and the risk propagation function, the result p of the p-th feature resource block at the first timing is estimated, and the first result includes the result p; The second set of feature resource blocks contains adjacent feature resource blocks that are correlated. The q-th feature resource block in the second set of feature resource blocks is a feature resource block that was not analyzed at the second time and is adjacent to the j-th feature resource block. The method further includes: Based on the result j and the risk propagation function, the result q of the qth feature resource block at the second timing is estimated, and the second result includes the result q.

9. The method according to claim 8, characterized in that, The result i, the risk propagation function, and the result p satisfy the following relationship: Risk_p = Risk_p_old + f(Risk_i * Corr_i, p); Where Risk_p is the result p, Risk_p_old is the historical analysis result of the information feature of the corresponding type p, the corresponding type p is the type of information feature contained in the p-th feature resource, f() is the risk propagation function, Risk_i is the result i, and Corr_i,p is the correlation strength between the p-th feature resource block and the i-th feature resource block; The result j, the risk propagation function, and the result q satisfy the following relationship: Risk_q=Risk_q_old+f(Risk_j*Corr_j,q); Wherein, Risk_q is the result q, Risk_q_old is the historical analysis result of the information feature of the corresponding type q, the corresponding type q is the type of information feature contained in the qth feature resource, f() is the risk propagation function, Risk_j is the result j, and Corr_j,q is the correlation strength between the qth feature resource block and the jth feature resource block.

10. The method according to claim 1, characterized in that, The first feature resource block set and the second feature resource block set respectively contain the following types of information features: traffic packet length distribution features, flow time interval features, traffic burst pattern features, session hold duration features, heartbeat signal periodic features, ciphertext randomness statistical features, or integrity check anomaly frequency features.

Images