A microservice secure communication method and system

Abstract

The application relates to the technical field of micro-service architecture management, and particularly discloses a micro-service secure communication method and system, which performs summation calculation on a basic deviation score, an intention tampering penalty score and a receiving suspiciousness of a current node to obtain an accumulated suspiciousness of the current node; if the accumulated suspiciousness of the current node is greater than a preset threshold and the basic deviation score of an incoming edge corresponding to the current node is zero, the reverse backtracking cycle is exited, and the current node is determined as a root cause node; if the accumulated suspiciousness of the current node is not greater than the preset threshold and the current node has a predecessor node, the accumulated suspiciousness of the current node is multiplied by a decay factor to obtain a derived suspiciousness, the derived suspiciousness is assigned to the receiving suspiciousness of the predecessor node, the predecessor node is updated to the current node, and the reverse backtracking cycle is continuously executed; a micro-isolation strategy is generated, and the micro-isolation strategy is issued to a service mesh control plane to intercept outgoing communication traffic of the root cause node carrying a delivery intention load.

Description

Technical Field

[0001] This invention relates to the field of microservice architecture management technology, and specifically to a microservice secure communication method and system. Background Technology

[0002] With the widespread adoption of microservice architecture in distributed systems, the communication links between services are becoming increasingly complex, posing significant challenges to security auditing and fault localization. Existing security communication monitoring methods primarily focus on post-event logging of call chains and basic anomaly alerts. While these methods can reveal the call topology between services through tracing identifiers, they struggle to quickly identify the true source of the attack from cascading communication responses when faced with complex security threats such as privilege escalation, unauthorized data tampering, or credential misuse. Traditional analysis models heavily rely on security administrators retrieving massive amounts of logs and performing manual logical deductions, resulting in lengthy average remediation times for security incidents and failing to meet the real-time defense requirements of cloud-native environments.

[0003] In related technologies, existing communication mechanisms lack cross-node transmission and consistency verification methods for the original operational intent. This leads to downstream nodes being unable to determine whether the intent has undergone unauthorized changes midway through the transmission chain when receiving a request. Due to the high concurrency of microservice communication, single static feature comparison is insufficient to adapt to normal fluctuations in business traffic, resulting in a lack of effective quantitative assessment criteria for suspicion levels in complex links. When anomalies occur, existing tracing mechanisms typically employ a full-path linear scan, failing to dynamically deduce the confidence level of suspicion based on the propagation characteristics of communication behavior. Consequently, it becomes difficult to distinguish between the root cause node controlled by the attacker and the victim node deceived by them, thus reducing the efficiency of secure communication. Summary of the Invention

[0004] In view of the problems existing in the prior art, the present invention provides a microservice secure communication method and system to solve the above-mentioned technical problems.

[0005] To achieve the above and other objectives, the technical solution adopted by the present invention is as follows: The first aspect of this invention provides a microservice secure communication method, the method comprising: Intercept the initial call request sent by the first node in the microservice communication link, extract the context features of the initial call request to generate the initial intent payload, and inject the initial intent payload and the link tracing identifier into the request header of the initial call request and pass it to the downstream nodes along the microservice communication link; When the tail node of the microservice communication link triggers a security interception event, extract the target link tracing identifier bound to the triggering security interception event, and pull the full communication span dataset corresponding to the target link tracing identifier; A directed acyclic execution graph containing a set of nodes and a set of directed edges is constructed using the full communication span dataset. Directed edge communication features and transmission intent payload are extracted from the full communication span dataset. The reception suspicion of all nodes in the directed acyclic execution graph is initialized to zero. A reverse backtracking loop is initiated for the directed acyclic execution graph. The reverse backtracking loop includes: Set the tail node as the current node, extract the directed edge communication features and transmission intention load of the incoming edge corresponding to the current node, calculate the deviation distance between the directed edge communication features and the historical normal behavior baseline model to obtain the basic deviation score, and compare the transmission intention load with the initial intention load to obtain the intention tampering penalty score. The cumulative suspicion of the current node is calculated by summing the base deviation score, the penalty score for attempted tampering, and the reception suspicion of the current node. If the cumulative suspicion of the current node is greater than the preset threshold and the basic deviation score of the incoming edge corresponding to the current node is zero, then exit the reverse backtracking loop and determine the current node as the root cause node. If the cumulative suspicion of the current node is not greater than the preset threshold and the current node has a predecessor node, multiply the cumulative suspicion of the current node by the decay factor to obtain the derived suspicion, assign the derived suspicion to the received suspicion of the predecessor node, update the predecessor node to the current node and continue to execute the reverse backtracking loop. Based on the root cause node identifier and the transmission intent load of the corresponding outgoing edge of the root cause node, a micro-segmentation policy is generated and sent to the service mesh control plane to intercept the outgoing communication traffic of the root cause node carrying the transmission intent load.

[0006] Preferably, the initial call request sent by the first node in the microservice communication link is intercepted, and the context features of the initial call request are extracted to generate the initial intent payload, including: Intercept the initial call request sent by the first node in the sidecar proxy layer of the microservice communication link, and parse the network protocol message of the initial call request; Extract the requester's identity credentials, request action type, and target access path from the network protocol message, and use the set of requester's identity credentials, request action type, and target access path as the context features of the initial call request. The requester's identity credentials, request action type, and target access path in the context features are concatenated in dictionary order to obtain the plaintext intent feature string. Obtain the private signature key pre-allocated by the system for the first node, and use the private signature key to perform encrypted hashing operation on the plaintext feature string of the intent to extract the intent signature digest; The plaintext intent feature string and the intent signature digest are combined and encrypted to generate the initial intent payload.

[0007] Preferably, a directed acyclic execution graph containing a set of nodes and a set of directed edges is constructed using the full communication span dataset. Directed edge communication features and the transmitted intent payload are extracted from the full communication span dataset, including: Extract the caller's network address, the called party's network address, and the time point from the full communication span dataset; A set of directed edges is generated by connecting the network addresses of the caller and the callee in chronological order. After deduplicating the microservice instances corresponding to the network addresses of the caller and the callee, a set of nodes is generated. The set of nodes and the set of directed edges are then combined to form a directed acyclic execution graph. For each directed edge in the set of directed edges, the corresponding communication message body length and parameter type are extracted from the full communication span dataset as directed edge communication features. Parse the communication span request header corresponding to each directed edge, and extract the content of the custom fields carried in the request header as the transmission intent payload.

[0008] Preferably, the baseline deviation score is derived by calculating the deviation distance between the directed edge communication features and the historical normal behavior baseline model, including: Extract the baseline mean of the communication message body length and the valid set of parameter types from the historical normal behavior baseline model; Calculate the absolute difference between the communication message body length and the baseline mean of the communication message body length in the directed edge communication features, and divide the absolute difference by the baseline mean of the communication message body length to obtain the length fluctuation rate; Verify whether the parameter types in the directed edge communication features belong to the valid set of parameter types; If the parameter type belongs to the valid set of parameter types, multiply the length volatility by the basic penalty coefficient to obtain the basic deviation score; If the parameter type does not belong to the valid set of parameter types, the length volatility is multiplied by the penalty amplification factor to obtain the basic deviation score.

[0009] Preferably, the intention tampering penalty is obtained by comparing the transmitted intention payload with the initial intention payload, including: The global public key of the sidecar proxy layer is used to decrypt the transmitted intent payload and extract the transmitted intent plaintext and the transmitted signature digest; A comparison signature digest is generated by performing a secondary hash operation on the plaintext of the transmitted intent using a global public key. Verify that the signature digest matches the transmitted signature digest. If there is a discrepancy, it is determined that the transmitted intent payload has been tampered with by a middleman, and the intent tampering penalty is assigned a preset extreme value; If they match, extract the current request action type from the plaintext of the transmitted intent and compare whether the current request action type matches the request action type in the initial intent payload; if they match, assign the intent tampering penalty to zero, otherwise assign the intent tampering penalty to the base tampering value.

[0010] Preferably, the cumulative suspicion level of the current node is multiplied by a decay factor to obtain the derived suspicion level, and the derived suspicion level is assigned to the reception suspicion level of the predecessor node, including: Extract the number of incoming edges of the current node in the directed acyclic execution graph; If the number of incoming edges of the current node is equal to one, it is determined that the current node has a unique predecessor node. A preset fixed attenuation constant is extracted as an attenuation factor. The derived attenuation factor obtained by multiplying the cumulative attenuation of the current node by the attenuation factor is directly assigned to the reception attenuation of the unique predecessor node. If the number of incoming edges of the current node is greater than one, it is determined that the current node has multiple concurrent predecessor nodes. The distribution weight is calculated based on the proportion of the communication message body length transmitted by each concurrent predecessor node to the total incoming message body length. The preset fixed attenuation constant is multiplied by the distribution weight as a weighted attenuation factor. The cumulative suspicion of the current node is multiplied by the weighted attenuation factor to obtain the traffic-derived suspicion. The traffic-derived suspicion is assigned to the reception suspicion of the corresponding concurrent predecessor node.

[0011] Preferably, the reverse backtracking loop also includes: If the cumulative suspicion score of the current node is greater than the preset threshold and the basic deviation score of the incoming edge corresponding to the current node is not zero, the current node is marked as a polluted node. Extract the intentional tampering penalty score of the incoming edge corresponding to the contaminated node. If the intentional tampering penalty score is greater than zero, the predecessor node is determined to be the deception initiator. The cumulative suspiciousness of the current node is directly assigned to the reception suspiciousness of the predecessor node without decay, and the predecessor node is updated to the current node to continue the reverse backtracking loop. If the current node has no predecessor node and the cumulative suspicion level of the current node is greater than the preset threshold, the reverse backtracking loop will be broken, and the current node will be determined as the root cause node of the chain head's fall.

[0012] Preferably, the micro-segmentation strategy generated based on the root cause node identifier and the transmission intent load of the outgoing edges corresponding to the root cause node includes: Extract the target access path from the directed edge communication features of the outgoing edges corresponding to the root cause node; The abnormal request action type is obtained by parsing the transmission intent load of the outgoing edge corresponding to the root cause node. Generate a five-tuple isolation rule by concatenating the root cause node identifier, the target access path, and the abnormal request action type; Define the effective time window and interception action identifier for the five-tuple isolation rule, and encapsulate the five-tuple isolation rule, effective time window, and interception action identifier into a micro-isolation policy.

[0013] Preferably, after issuing the micro-segmentation policy to the service mesh control plane to intercept outbound communication traffic from root cause nodes carrying transmission intent payloads, the process also includes: Within the effective time window, count the number of access denial log entries blocked by the service mesh control plane; If the number of access denied log entries exceeds the preset attack frequency, a baseline update command will be triggered. Based on the baseline update instruction, all directed edge communication features generated by root cause nodes are removed from the full communication span dataset. The remaining communication span data after removal is used to recalculate the baseline mean of the communication message body length, thereby updating the historical normal behavior baseline model.

[0014] A second aspect of the present invention provides a microservice secure communication system, the system comprising: The node delivery module is used to intercept the initial call request sent by the first node in the microservice communication link, extract the context features of the initial call request to generate the initial intent payload, and inject the initial intent payload and the link tracing identifier into the request header of the initial call request and pass it to the downstream nodes along the microservice communication link. The identifier extraction module is used to extract the target link tracing identifier bound to the security interception event when the tail node of the microservice communication link triggers a security interception event, and pull the full communication span dataset corresponding to the target link tracing identifier. The building module is used to construct a directed acyclic execution graph containing a set of nodes and a set of directed edges using the full communication span dataset. It extracts the communication features of the directed edges and the transmission intent payload from the full communication span dataset and initializes the reception suspicion of all nodes in the directed acyclic execution graph to zero. The backtracking loop module is used to initiate a reverse backtracking loop for a directed acyclic execution graph. The reverse backtracking loop includes: setting the tail node as the current node; extracting the directed edge communication features and transmission intent payload of the incoming edge corresponding to the current node; calculating the deviation distance between the directed edge communication features and the historical normal behavior baseline model to obtain the basic deviation score; comparing the transmission intent payload with the initial intent payload to obtain the intent tampering penalty score; summing the basic deviation score, intent tampering penalty score, and the current node's reception suspicion score to obtain the current node's cumulative suspicion score; if the current node's cumulative suspicion score is greater than a preset threshold and the basic deviation score of the incoming edge corresponding to the current node is zero, then exiting the reverse backtracking loop and determining the current node as the root cause node; if the current node's cumulative suspicion score is not greater than a preset threshold and the current node has a predecessor node, multiplying the current node's cumulative suspicion score by a decay factor to obtain the derived suspicion score; assigning the derived suspicion score to the predecessor node's reception suspicion score; updating the predecessor node as the current node and continuing to execute the reverse backtracking loop. The policy generation module is used to generate micro-segmentation policies based on the root cause node identifier and the transmission intent load of the corresponding outgoing edge of the root cause node, and to send the micro-segmentation policies to the service mesh control plane to intercept outgoing communication traffic of the root cause node carrying the transmission intent load.

[0015] As described above, the microservice secure communication method and system provided by the present invention have at least the following beneficial effects: This invention intercepts requests from the first node of a microservice to extract contextual features, generates an initial intent payload, and injects a link tracing identifier. When the tail node triggers an interception event, it pulls the full span data to construct a directed acyclic execution graph. Then, during graph traversal, it combines actual communication features with historical baseline deviation distances to calculate a basic deviation score and compares the transmitted intent with the initial intent to output intent tampering penalty scores. This enables the system to adaptively perform multi-dimensional joint quantitative evaluation of traffic behavior distortion and instruction overreach behavior in complex cascading calls. It effectively avoids the rigidity of traditional microservice security systems that rely solely on single-point boundary defense and static traffic matching, which makes defenses easily bypassed and intents easily tampered with by intermediate proxies. It tightly integrates network basic anomaly judgment with intrinsic business intent anti-counterfeiting verification, deeply aligning with the real security defense requirements of highly dynamic interactions under cloud-native architecture, thereby effectively improving the efficiency of secure communication in microservices.

[0016] This invention uses deep correlation between the current node's suspiciousness and the local deviation characteristics of incoming edges to penetrate long links and determine the true root cause node of the attack. Based on the root cause node's identifier and outward abnormal intent, it directly generates a targeted micro-isolation strategy and sends it to the service mesh control plane for interception. This not only helps security operations teams to remove normal traffic noise and lock the extremely hidden source of attacks in complex mesh microservice topologies in seconds, but also maximizes the business continuity of other healthy microservices while cutting off malicious lateral propagation paths. It significantly improves the automated source tracing capability of distributed clusters when facing deep and persistent penetration attacks. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a schematic diagram showing the connections between the steps of the method of the present invention.

[0019] Figure 2 This is a schematic diagram showing the connections of the various modules in the system of the present invention. Detailed Implementation

[0020] The following description, in conjunction with the implementation of this invention, is merely an example and illustration of the concept of this invention. Those skilled in the art can make various modifications or additions to the specific embodiments described, or use similar methods to replace them, as long as they do not deviate from the inventive concept or exceed the scope defined in these claims, all of which should fall within the protection scope of this invention.

[0021] Example 1: Reference Figure 1 A secure communication method for microservices includes the following steps: Intercept the initial call request sent by the first node in the microservice communication link, extract the context features of the initial call request to generate the initial intent payload, and inject the initial intent payload and the link tracing identifier into the request header of the initial call request and pass it to the downstream nodes along the microservice communication link; When the tail node of the microservice communication link triggers a security interception event, extract the target link tracing identifier bound to the triggering security interception event, and pull the full communication span dataset corresponding to the target link tracing identifier; A directed acyclic execution graph containing a set of nodes and a set of directed edges is constructed using the full communication span dataset. Directed edge communication features and transmission intent payload are extracted from the full communication span dataset. The reception suspicion of all nodes in the directed acyclic execution graph is initialized to zero. A reverse backtracking loop is initiated for the directed acyclic execution graph. The reverse backtracking loop includes: Set the tail node as the current node, extract the directed edge communication features and transmission intention load of the incoming edge corresponding to the current node, calculate the deviation distance between the directed edge communication features and the historical normal behavior baseline model to obtain the basic deviation score, and compare the transmission intention load with the initial intention load to obtain the intention tampering penalty score. The cumulative suspicion of the current node is calculated by summing the base deviation score, the penalty score for attempted tampering, and the reception suspicion of the current node. If the cumulative suspicion of the current node is greater than the preset threshold and the basic deviation score of the incoming edge corresponding to the current node is zero, then exit the reverse backtracking loop and determine the current node as the root cause node. If the cumulative suspicion of the current node is not greater than the preset threshold and the current node has a predecessor node, multiply the cumulative suspicion of the current node by the decay factor to obtain the derived suspicion, assign the derived suspicion to the received suspicion of the predecessor node, update the predecessor node to the current node and continue to execute the reverse backtracking loop. Based on the root cause node identifier and the transmission intent load of the corresponding outgoing edge of the root cause node, a micro-segmentation policy is generated and sent to the service mesh control plane to intercept the outgoing communication traffic of the root cause node carrying the transmission intent load.

[0022] In a specific embodiment, the initial call request refers to the first network access data initiated by the first node in the microservice communication link to the internal system. Specifically, it can be captured by a traffic transparent hijacking mechanism through a sidecar proxy layer deployed at the bottom of the service mesh, and used as the lossless data starting point for subsequent intent tracking and source analysis. The initial intent payload refers to the encrypted anti-counterfeiting identification data generated after extracting the context features of the first node's request. Specifically, it can be encapsulated by a combination of dictionary sorting, hash calculation and asymmetric encryption algorithms, and used to solidify and protect the original purpose of the microservice's real call, preventing it from being secretly tampered with during transmission.

[0023] Among them, the link tracing identifier refers to the globally unique identifier that runs through the entire microservice distributed call chain. Specifically, it can be implemented by using a unique request serial number generated by the distributed tracing component. It is used to connect and assemble complete communication span data across service nodes. The full communication span dataset refers to the data set containing point-to-point communication records between all microservice nodes in the target request chain. Specifically, it can be implemented by aggregating and extracting log streams from the distributed tracing system. It is used to restore the real topology and traffic characteristics of microservice cascading calls.

[0024] Among them, the directed acyclic execution graph refers to a graph structure that reflects the actual call order, constructed using the logical connection relationship between time points and network addresses. Specifically, it can be implemented using memory graph database mapping or object vertex splicing algorithms, and is used to provide topological path support without blind spots for reverse risk tracing. The directed edge communication feature refers to a multi-dimensional parameter set that characterizes the basic communication behavior pattern between microservices. Specifically, it can be implemented by deep parsing the length of the communication message body and the parameter structure type, and is used to compare the deviation with the historical normal baseline and calculate the basic risk value.

[0025] Among them, the basic deviation score refers to the quantified deviation of the current node's inbound communication characteristics from the historical normal behavior baseline model in terms of message size and data structure. Specifically, it can be implemented by multiplying the absolute difference with the dynamic penalty coefficient, and is used to assess the degree of abnormality in traffic behavior of a single point-to-point communication. The intent tampering penalty score refers to the risk weighting value generated when the intent payload transmitted by the intermediate node is inconsistent with the initial intent payload of the first node. Specifically, it can be implemented by global public key asymmetric decryption verification and instruction semantic feature comparison, and is used to identify man-in-the-middle hijacking or unauthorized tampering behavior in the link. The cumulative suspiciousness refers to a comprehensive evaluation value that integrates communication basic anomalies, intent tampering penalties, and downstream backhaul risks. Specifically, it can be implemented by linear summation of multi-dimensional risk scores, and is used to comprehensively determine whether the current node has reached a dangerous state of being controlled or launching an attack.

[0026] Among them, the reverse backtracking loop refers to the dynamic transmission mechanism of suspicion degree calculation by traversing the edges of the directed acyclic execution graph in reverse. Specifically, it can be implemented by using graph theory recursive algorithm and the logic of multiplying the risk by the network hop count attenuation coefficient. It is used to trace back and lock the source of risk across nodes in complex mesh microservice topologies. The root cause node refers to the source node in the microservice communication link that actually initiates malicious behavior or is the first to be penetrated and exploited. Specifically, it can be established by determining that the current node's cumulative suspicion degree exceeds the threshold and its inbound edge basic deviation score is zero. It is used as the precise target for subsequent targeted network isolation. The micro-isolation strategy refers to the targeted network blocking rules generated for specific dangerous communication paths and tampered instructions. Specifically, it can be implemented by extracting five-tuple rules and encapsulating them into a policy file and sending it to the service mesh control plane. It is used to achieve precise and automated outbound traffic interception without loss of business.

[0027] The working process and principle of this application are as follows: First, intercept the initial call request sent by the first node in the microservice communication link, extract the context features of the initial call request to generate the initial intent payload, and inject the initial intent payload and the link tracing identifier into the request header of the initial call request and pass it down the microservice communication link to downstream nodes; then, when the tail node of the microservice communication link triggers a security interception event, extract the target link tracing identifier bound to the triggering security interception event, and pull the full communication span dataset corresponding to the target link tracing identifier; next, use the full communication span dataset to construct a directed acyclic execution graph containing a set of nodes and a set of directed edges, extract the directed edge communication features and the transmitted intent payload from the full communication span dataset, and initialize the reception suspicion of all nodes in the directed acyclic execution graph to zero; then, start a reverse backtracking loop for the directed acyclic execution graph, set the tail node as the current node, extract the directed edge communication features and the transmitted intent payload of the incoming edges corresponding to the current node, calculate the deviation distance between the directed edge communication features and the historical normal behavior baseline model to obtain the basic deviation score, and compare it with... The process involves calculating the intent tampering penalty based on the transmitted intent payload and the initial intent payload. The cumulative suspicion score of the current node is calculated by summing the base deviation score, the intent tampering penalty score, and the current node's reception suspicion score. If the current node's cumulative suspicion score is greater than a preset threshold and the base deviation score of the corresponding incoming edge is zero, the reverse backtracking loop is exited, and the current node is identified as the root cause node. If the current node's cumulative suspicion score is not greater than the preset threshold and the current node has a predecessor node, the current node's cumulative suspicion score is multiplied by a decay factor to obtain a derived suspicion score. This derived suspicion score is then assigned to the predecessor node's reception suspicion score, the predecessor node is updated to the current node, and the reverse backtracking loop continues. Finally, a micro-segmentation policy is generated based on the root cause node identifier and the transmitted intent payload of the corresponding outgoing edge of the root cause node. This policy is then sent to the service mesh control plane to intercept outbound communication traffic from the root cause node carrying the transmitted intent payload. In this way, automated reverse tracing and targeted isolation of covert attack behaviors in complex microservice communication links are achieved, ensuring the security and high availability of the global business links.

[0028] Furthermore, the initial call request sent by the first node in the microservice communication chain is intercepted, and the context features of the initial call request are extracted to generate the initial intent payload, including: Intercept the initial call request sent by the first node in the sidecar proxy layer of the microservice communication link, and parse the network protocol message of the initial call request; Extract the requester's identity credentials, request action type, and target access path from the network protocol message, and use the set of requester's identity credentials, request action type, and target access path as the context features of the initial call request. The requester's identity credentials, request action type, and target access path in the context features are concatenated in dictionary order to obtain the plaintext intent feature string. Obtain the private signature key pre-allocated by the system for the first node, and use the private signature key to perform encrypted hashing operation on the plaintext feature string of the intent to extract the intent signature digest; The plaintext intent feature string and the intent signature digest are combined and encrypted to generate the initial intent payload.

[0029] In a specific embodiment, the detailed implementation logic for intercepting the initial call request sent by the first node in the microservice communication link and extracting the context features of the initial call request to generate the initial intent payload is as follows: First, the system uses a sidecar proxy layer deployed at the bottom layer of the microservice's runtime environment to capture the outbound network data stream (initial call request) sent out by the first node using a traffic transparent hijacking mechanism. Then, the intercepted outbound network data stream is unpacked and converted according to the network communication protocol specification to parse a network protocol message with a complete field structure. Next, the system deeply traverses the header and payload area of ​​the network protocol message, extracts the requester's identity credentials used to verify the subject's permissions from the authorization request header field using parameter name matching rules, and extracts the representative... The system identifies the request action type of the specific business operation instruction and extracts the target access path from the resource location address area. The extracted requester identity credentials, request action type, and target access path are then structurally combined to form a set representing the core purpose of this request, which serves as the context feature of the initial call request. To ensure the consistency of subsequent signature calculations and the stability of anti-tampering verification, the system must perform standardized formatting of the data within the context feature. This involves forcibly sorting the key names of the requester identity credentials, request action type, and target access path in ascending order according to the alphabetical order, and using a specific connector to concatenate the corresponding parameter values ​​sequentially. During this process, all spaces and newline redundant characters are removed to obtain a standardized string of intent plaintext features. Subsequently, the system calls the underlying security interface to access the local protected storage medium to obtain the private signature key pre-assigned and uniquely bound to the service mesh control center as the first node. The plaintext intent feature string is input into the secure hash algorithm engine to generate a fixed-length hash value. Then, the obtained private signature key is used to perform an asymmetric digital signature operation on the hash value to extract an intent signature digest with non-repudiation and tamper-proof characteristics. Finally, the system combines the plaintext intent feature string and the intent signature digest into key-value pairs according to the standard serialized data format, and uses a global symmetric encryption algorithm at the communication layer to perform full encryption encapsulation on the combined data body to generate the initial intent payload in ciphertext form.

[0030] Furthermore, a directed acyclic execution graph containing a set of nodes and a set of directed edges is constructed using the full communication span dataset. Directed edge communication features and the transmitted intent payload are extracted from the full communication span dataset, including: Extract the caller's network address, the called party's network address, and the time point from the full communication span dataset; A set of directed edges is generated by connecting the network addresses of the caller and the callee in chronological order. After deduplicating the microservice instances corresponding to the network addresses of the caller and the callee, a set of nodes is generated. The set of nodes and the set of directed edges are then combined to form a directed acyclic execution graph. For each directed edge in the set of directed edges, the corresponding communication message body length and parameter type are extracted from the full communication span dataset as directed edge communication features. Parse the communication span request header corresponding to each directed edge, and extract the content of the custom fields carried in the request header as the transmission intent payload.

[0031] In a specific embodiment, a directed acyclic execution graph containing a set of nodes and a set of directed edges is constructed using the full communication span dataset. The detailed implementation logic for extracting directed edge communication features and transmitting intent payload from the full communication span dataset is as follows: First, the system traverses each independent span record in the retrieved full communication span dataset, parses the network address of the caller representing the initiator of the communication request and the network address of the receiver representing the receiver of the request from the underlying fields of the network protocol stack, and simultaneously extracts the exact time point of the communication to be recorded, which serves as the baseline data for reconstructing the time sequence relationship of complex service interactions. Next, to realistically reproduce the cascading call topology of the microservice chain, the system performs an ascending sort operation on the extracted time point data. Logically connects the caller's network address as the starting vector and the called party's network address as the ending vector according to the chronological order, thereby generating a set of directed edges representing the data flow and the actual call order. At the same time, the system performs instance mapping lookup on all the parsed caller and called party network addresses to identify the specific microservice instance identifiers corresponding to them in the service registry. Redundant duplicate instance records are removed using a hash set deduplication algorithm to generate a set of nodes representing each independent participating unit in this chain. Subsequently, the system uses this set of nodes as the data vertices of the graph structure in the memory space, and splices and maps the aforementioned set of directed edges as the connecting edges of the graph to construct a directed acyclic execution graph that can completely reflect the complete execution trajectory of the target request in the distributed system. For each directed edge in the directed edge set, the system reverse-indexes the entire communication span dataset based on its unique span identifier, reads the payload segment of the point-to-point communication message, calculates the total number of bytes after serialization to extract the corresponding communication message body length, and deeply analyzes the data format identifier and business method definition structure in the request payload to determine the corresponding parameter type. The communication message body length and parameter type are combined dimensionally to represent the directed edge communication characteristics that characterize the basic communication behavior pattern between microservices. Finally, in order to track the fidelity of the transmission of security intent throughout the entire link, the system further analyzes the communication span request header data area of ​​the communication traffic corresponding to each directed edge, scans the request header area using pre-configured key name matching rules, locates and extracts the encrypted payload data carried in specific custom fields in the request header, and uses it as the transmission intent payload on the communication edge. This process not only completes the data transformation from unstructured communication logs of the distributed system to a structured graph model, but also ensures the lossless extraction of security intent payloads during cross-service calls, providing key graph basis and multi-dimensional feature input for subsequent node anomaly assessment and intent tampering determination.

[0032] Furthermore, the deviation distance between the directed edge communication features and the historical normal behavior baseline model is calculated to obtain the basic deviation score, including: Extract the baseline mean of the communication message body length and the valid set of parameter types from the historical normal behavior baseline model; Calculate the absolute difference between the communication message body length and the baseline mean of the communication message body length in the directed edge communication features, and divide the absolute difference by the baseline mean of the communication message body length to obtain the length fluctuation rate; Verify whether the parameter types in the directed edge communication features belong to the valid set of parameter types; If the parameter type belongs to the valid set of parameter types, multiply the length volatility by the basic penalty coefficient to obtain the basic deviation score; If the parameter type does not belong to the valid set of parameter types, the length volatility is multiplied by the penalty amplification factor to obtain the basic deviation score.

[0033] In a specific embodiment, the detailed implementation logic for calculating the deviation distance between the directed edge communication features and the historical normal behavior baseline model to obtain the basic deviation score is as follows: The historical normal behavior baseline model is obtained by collecting massive amounts of full communication span data of the microservice cluster during historical attack-free periods as training samples. Specifically, the system uses a Gaussian mixture model as the underlying unsupervised training model, setting a maximum iteration count of 500 and a model convergence threshold of 10 to the power of -4 as core training parameters. The expectation-maximization algorithm is used to perform parameter estimation and multidimensional probability density fitting iterations on the training samples until the set maximum iteration count is reached or the error is lower than the convergence threshold, thus completing the process. The model converges, thereby extracting and solidifying the baseline mean of the communication message body length and the legal set of parameter types for specific microservice interfaces. At the same time, the system dynamically derives the penalty parameters based on the statistical distribution characteristics of the training samples, extracts the standard deviation data of the message body length in the training samples, and uses the reciprocal of the standard deviation after normalization as the basic penalty coefficient. This ensures that the basic penalty for microservice interfaces with greater historical data fluctuations is smaller, thereby improving fault tolerance. Furthermore, a verification sample set containing known abnormal attack type characteristics is introduced for cross-validation evaluation. Based on the risk impact weight of non-legal parameters causing system anomalies or data leakage, the optimal penalty amplification coefficient, which is much greater than the basic penalty coefficient, is calculated through a grid search algorithm. After completing the model and parameter initialization, the system connects to and reads the pre-trained historical normal behavior baseline model deployed in the security analysis center. Based on the microservice interface identifier currently being evaluated, the system extracts the baseline mean of the communication message body length obtained from the long-term historical stable traffic aggregation from the model. Simultaneously, the system reads all the legal data structure definition specifications allowed to be received by the interface to construct a legal set of parameter types. Then, the system extracts the actual intercepted communication message body length from the current directed edge communication features, subtracts it from the extracted baseline mean of the communication message body length, and takes the absolute value to obtain the absolute difference in data packet volume between the two. To eliminate the interference of dimensions caused by the difference in data scale of different microservice business interfaces, the absolute difference is further divided by the average baseline length of the communication message body to calculate the length fluctuation rate, which can objectively and normally reflect the deviation of the real traffic from the normal business baseline. Then, the system triggers the judgment logic for the security characteristics of the communication data structure. Through hash lookup or set inclusion matching algorithm, it verifies whether the actual parameter type parsed from the directed edge communication characteristics completely belongs to the aforementioned legal parameter type set. This verifies whether there is any unexpected parameter type injection or unauthorized probe behavior. If the verification result shows that the parameter type belongs to the legal parameter type set, it means that although the current communication request has scaling changes in message volume, its data structure still conforms to the expected business specifications. It is usually a natural oscillation phenomenon of legitimate business traffic. At this time, the system executes a mild quantitative penalty mechanism, multiplying the previously calculated length fluctuation rate by the previously derived and relatively small basic penalty coefficient, and obtains the basic deviation score through linear mapping calculation. Conversely, if the verification result indicates that the parameter type does not belong to the valid parameter type set, it means that the communication interaction not only experienced abnormal fluctuations in data transmission volume, but also was very likely to carry unauthorized non-standard instructions or malicious attack payloads, which is a behavior that seriously deviates from security expectations. At this time, the system will trigger the risk amplification judgment branch, multiplying the length fluctuation rate by the penalty amplification coefficient derived above, which is much larger than the basic penalty coefficient. This numerical amplification multiplication mechanism for unknown parameter formats is used to drastically increase the risk assessment weight, thereby obtaining the basic deviation score under this high-risk scenario. This step, by deeply integrating the two dimensions of traffic size deviation and structural type legality, and using differentiated product penalty logic, transforms the multi-dimensional communication behavior deviation distance into a unified standardized numerical indicator, providing a high-fidelity and anti-interference basic data source for the subsequent cumulative suspiciousness calculation of the link.

[0034] Furthermore, the intent tampering penalty is derived by comparing the transmitted intent payload with the initial intent payload, including: The global public key of the sidecar proxy layer is used to decrypt the transmitted intent payload and extract the transmitted intent plaintext and the transmitted signature digest; A comparison signature digest is generated by performing a secondary hash operation on the plaintext of the transmitted intent using a global public key. Verify that the signature digest matches the transmitted signature digest. If there is a discrepancy, it is determined that the transmission intent payload has been tampered with by a middleman, and an intent tampering penalty is assigned a preset extreme value; the magnitude of the preset extreme value is pre-set to be greater than any possible combination of the sum of the base deviation score and the base tampering value, so as to ensure that once signature tampering is detected, regardless of the risk scores of other dimensions, the node will inevitably be judged as a highly suspicious node by the cumulative suspiciousness calculation logic. If they match, extract the current request action type from the plaintext of the transmitted intent and compare whether the current request action type matches the request action type in the initial intent payload; if they match, assign the intent tampering penalty to zero, otherwise assign the intent tampering penalty to the base tampering value.

[0035] In a specific embodiment, the detailed implementation logic for comparing the transmitted intent payload with the initial intent payload to obtain the intent tampering penalty is as follows: First, the system calls the cryptographic service interface deployed at the bottom layer of the microservice mesh communication. Using the secure global public key uniformly distributed and managed by the sidecar proxy layer, it performs a standard asymmetric decryption operation on the intercepted transmitted intent payload with an encrypted shell, removes its network transmission encapsulation shell and strips the data protection layer, thereby extracting the transmitted intent plaintext and the transmitted signature digest used for integrity verification. Then, in order to strictly prevent the plaintext content from being silently corrupted in the distributed cascading call, the system calls the secure hash algorithm engine that matches the system's encryption rules in the memory environment. Using the security verification parameter system built into the global public key, it performs a secondary one-way hash operation on the unprotected transmitted intent plaintext, re-derives and generates a comparison signature digest for comparison reference. The system calls the underlying binary memory matching function of the operating system to verify, byte by byte, whether the comparison signature digest generated in real time based on the current plaintext and the transmitted signature digest obtained by decoding show absolute consistency at the character sequence level. If the memory matching function returns a signal that the two are inconsistent, it means that the network data has been intervened by malicious programs and has undergone unauthorized data replacement or tampering during the flow of multi-hop intermediate nodes. Based on this, the system quickly jumps out of the regular business check and determines that the transmitted intent payload has been subjected to a man-in-the-middle tampering attack. In order to enable the contaminated node to be instantly identified in the subsequent graph backtracking algorithm, the system forcibly assigns a preset extreme value to the actual associated intent tampering penalty that is sufficient to break through the normal trust score. Conversely, if the memory matching function returns consistent verification, it indicates that the cryptographic security of the payload at the physical communication layer has not been compromised. The system then deepens the verification level to a more sophisticated business semantic anti-unauthorization verification stage. It uses a text deserialization component to accurately extract key execution instruction characters from the plaintext of the transmitted intent as the current request action type, and obtains the initial intent payload created at the beginning of this link access across nodes. It performs a deep consistency matching test on the current request action type and the original request action type fixed in the initial intent payload to verify whether any intermediate microservice proxy that has taken over the request has arbitrarily upgraded the operation permission level of the original originator. If the comparison result shows a complete match, the system determines that the intent of the call chain has high loyalty and has not been actively diffused, and thus assigns an intent tampering penalty of zero to prevent risk accumulation. If the comparison result shows a mismatch, that is, the operation attribute has been secretly upgraded or changed, the system determines that there is a risk of intent permission drift at the intrinsic code logic level, and triggers constraint degradation logic to assign an intent tampering penalty of a basic tampering value used to characterize abnormal fluctuations in business logic.

[0036] Furthermore, the cumulative suspicion level of the current node is multiplied by a decay factor to obtain the derived suspicion level. This derived suspicion level is then assigned to the reception suspicion level of the predecessor node, including: Extract the number of incoming edges of the current node in the directed acyclic execution graph; If the number of incoming edges of the current node is equal to one, it is determined that the current node has a unique predecessor node. A preset fixed attenuation constant is extracted as an attenuation factor. The derived attenuation factor obtained by multiplying the cumulative attenuation of the current node by the attenuation factor is directly assigned to the reception attenuation of the unique predecessor node. If the number of incoming edges of the current node is greater than one, it is determined that the current node has multiple concurrent predecessor nodes. The distribution weight is calculated based on the proportion of the communication message body length transmitted by each concurrent predecessor node to the total incoming message body length. The preset fixed attenuation constant is multiplied by the distribution weight as a weighted attenuation factor. The cumulative suspicion of the current node is multiplied by the weighted attenuation factor to obtain the traffic-derived suspicion. The traffic-derived suspicion is assigned to the reception suspicion of the corresponding concurrent predecessor node.

[0037] In a specific embodiment, the derived suspicion score is obtained by multiplying the cumulative suspicion score of the current node by a decay factor. The detailed implementation logic of assigning the derived suspicion score to the reception suspicion score of the predecessor node is as follows: First, the system accesses the data structure of the current node in the graph traversal engine and uses graph theory algorithms to count the total number of directed edges pointing to the current node in the directed acyclic execution graph. This is used to extract the number of incoming edges of the current node in the graph topology. This value directly reflects the number of direct upstream call sources received by the current microservice instance in the business flow. Then, the system triggers the branch judgment logic based on the graph topology. If the count of incoming edges of the current node is equal to one, the system determines that the current node is in the call chain. Driven by a single business logic, i.e., with a single predecessor node, in this linear call single backtracking scenario, the system reads a pre-set fixed attenuation constant from the global security configuration center to characterize the physical transmission loss law of risk between services, directly extracts it as the attenuation factor of the current tracing step, and then performs a scalar multiplication operation on the current node's accumulated risk assessment value, i.e., the accumulated suspicion degree, with the attenuation factor to calculate the derived suspicion degree after network hop attenuation loss, and uses the object memory address mapping mechanism to directly write and assign the derived suspicion degree to the receiving suspicion degree field in the data model of the single predecessor node, thereby realizing the reverse tracing back of single-line risk; Conversely, if the graph traversal engine determines that the number of incoming edges of the current node is greater than one, it means that the current microservice instance, as an aggregation service node, is simultaneously receiving concurrent requests from multiple upstream callers. This indicates that the current node has multiple concurrent predecessor nodes. To prevent malicious attackers from using high-volume normal requests to mask low-volume attack payloads and thus dilute the suspiciousness allocation, the system first extracts the intent tampering penalty score of the incoming edges corresponding to each concurrent predecessor node for severity screening. If the intent tampering penalty score of any concurrent predecessor node is detected to be marked as a preset extreme value, it indicates that the predecessor node has committed conclusive signature tampering or man-in-the-middle attack behavior, and the subsequent steps are skipped. The system employs a traffic-based risk allocation logic, directly assigning the current node's cumulative suspiciousness to the malicious predecessor node's reception suspiciousness without any attenuation. Only when the intentional tampering penalty scores of all concurrent predecessor nodes have not reached a preset extreme value does the system activate a risk allocation mechanism based on data traffic scale. To reasonably and dynamically distribute risk responsibility among multiple potential suspicious sources and avoid misjudgments, the system immediately activates this mechanism. The system iterates through all concurrent predecessor nodes pointing to the current node, extracting the communication message body length from the directed edge communication characteristics generated when they send network requests to the current node. The system sums the lengths of the communication packets transmitted by all concurrent predecessor nodes to obtain the total inbound packet length of the current node. Then, for each independent concurrent predecessor node, the system divides its individual communication packet length by the calculated total inbound packet length. Through this traffic load percentage division mapping method, the system calculates the distribution weight of each concurrent predecessor node's impact on the current node's abnormal state. Based on this calculation, the system extracts the aforementioned preset fixed attenuation constant and multiplies it by the distribution weight specific to each node, thereby generating a weighted attenuation factor for different concurrent request sources. Finally, the system assigns the current node... The total cumulative suspiciousness is multiplied by its corresponding weighted decay factor to obtain the traffic-derived suspiciousness with dynamic traffic awareness. Through the graph database attribute update interface, these traffic-derived suspiciousnesses are accurately assigned and appended to the receiving suspiciousness parameters of the corresponding concurrent predecessor nodes. This multi-branch risk backtracking allocation mechanism, which integrates topology judgment and traffic weight allocation, effectively overcomes the average allocation error or responsibility cover-up problem that is very easy to occur when reverse deducing risks in complex mesh microservice architectures. It ensures that the security threat confidence can be scientifically and adaptively decayed and propagated along the most likely real malicious data flow path.

[0038] Furthermore, the reverse backtracking loop also includes: If the cumulative suspicion score of the current node is greater than the preset threshold and the basic deviation score of the incoming edge corresponding to the current node is not zero, the current node is marked as a polluted node. Extract the intentional tampering penalty score of the incoming edge corresponding to the contaminated node. If the intentional tampering penalty score is greater than zero, the predecessor node is determined to be the deception initiator. The cumulative suspiciousness of the current node is directly assigned to the reception suspiciousness of the predecessor node without decay, and the predecessor node is updated to the current node to continue the reverse backtracking loop. If the current node has no predecessor node and the cumulative suspicion level of the current node is greater than the preset threshold, the reverse backtracking loop will be broken, and the current node will be determined as the root cause node of the chain head's fall.

[0039] In a specific embodiment, the deep judgment logic and state transition process inside the reverse backtracking loop are as follows: First, in each iteration, the system uses the logic judgment engine to compare the running parameters of the current node. If the cumulative suspiciousness of the current node has exceeded the system's preset security threshold, and further by searching the edge attributes of the directed acyclic execution graph, it is found that the basic deviation score of the corresponding incoming edge of the current node is not zero, which proves that the traffic entering the node has shown significant abnormal behavior characteristics in the dimensions of packet body length or parameter type. Based on this, the system confirms that the node is not the initiator of the attack but an intermediate victim affected by the abnormal traffic upstream, and marks the current node as a contaminated node by modifying the node metadata status bit. Next, the system performs a penetrating deep analysis of the inbound attack attributes of the contaminated node, extracting the intent tampering penalty value of the corresponding incoming edge. If the intent tampering penalty value is found to be greater than zero, it indicates that the upstream node not only deviated from the communication behavior when transmitting requests to the downstream, but also actively tampered with the underlying digital signature or the original operation intent. Based on this, the system logically determines that the predecessor node has extremely high malicious attack attributes or has been deeply controlled, defining it as the deception initiator. To prevent the characteristic value of the key attack source from being diluted by the normal attenuation mechanism in the complex cascading backtracking, the system triggers non-linear risk penetration logic at this time, forcibly bypassing the aforementioned attenuation factor calculation steps, and directly calculating the cumulative suspiciousness of the current node without any numerical loss. The system assigns the full value of the received suspiciousness to the predecessor node, thereby achieving saturated tracing of risk weights. It then uses a recursive pointer offset mechanism to update the predecessor node as the current node in the next loop to continue the reverse backtracking. Finally, the system performs a completeness check on the topological boundary of the link. If, after tracing up level by level, it is found that the current node no longer has any predecessor nodes, it means that the backtracking process has reached the logical starting point of the microservice communication link. In this state, if the cumulative suspiciousness of the current node is still greater than the preset threshold and cannot be further deduced upstream through the abnormal characteristics of the incoming edges, it proves that the node has autonomously generated outbound behavior that violates the baseline without receiving any abnormal input. Based on this, the system jumps out of the reverse backtracking loop and determines the current node as the root cause node of the entire link's head failure.

[0040] Furthermore, a micro-segmentation strategy is generated based on the root cause node identifier and the transmission intent load of the outgoing edges corresponding to the root cause node, including: Extract the target access path from the directed edge communication features of the outgoing edges corresponding to the root cause node; The abnormal request action type is obtained by parsing the transmission intent load of the outgoing edge corresponding to the root cause node. Generate a five-tuple isolation rule by concatenating the root cause node identifier, the target access path, and the abnormal request action type; Define the effective time window and interception action identifier for the five-tuple isolation rule, and encapsulate the five-tuple isolation rule, effective time window, and interception action identifier into a micro-isolation policy.

[0041] In a specific embodiment, the detailed implementation logic of generating a micro-segmentation strategy based on the root cause node identifier and the transmission intent load of the corresponding outgoing edge of the root cause node is as follows: First, after the system locates the real root cause node through a reverse backtracking algorithm, in order to achieve network blocking without service loss, the system queries the memory graph structure to traverse all associated directed edges sent out by the root cause node. From the communication characteristics of the directed edges of its corresponding outgoing edges, the system extracts the target access path used to identify the specific application interface or resource locator of the victim microservice, thereby clarifying the concrete location of the resource that has been maliciously probed or accessed without authorization. Then, for this same outgoing abnormal communication link, the system calls the deep packet analysis engine to perform structural decomposition and semantic restoration of the transmission intent load mounted on the outgoing edge, extracting the already... The system identifies the abnormal request action type by identifying the illegally unauthorized or tampered instruction. Then, it uses the confirmed unique root node identifier as the source attribute for security control, the previously extracted target access path as the destination attribute for security control, and the abnormal request action type as a restriction condition for the protocol operation dimension. The system calls the internal policy reconstruction component and, through string concatenation and standardized data structure mapping mechanism, merges and combines these three core security elements according to the format requirements of the standard network security access control matrix to generate a five-tuple isolation rule with high fine-grained access control capabilities. This rule logically abandons the drawbacks of traditional coarse-grained full-node physical blocking and achieves targeted locking only for specific dangerous communication paths and specific dangerous instructions. Finally, to ensure the dynamic adaptability of the defense system and the compatibility of the underlying mesh, the system sets an effective time window for the five-tuple isolation rule through a time-point estimation function to control the defense cycle and prevent the temporary isolation policy from causing deadlocks for future legitimate services. It also configures an interception action identifier to instruct the underlying firewall to perform packet dropping. Using standardized data serialization technology, the five-tuple isolation rule, effective time window, and interception action identifier are uniformly structured, packaged, and encapsulated in a data format to ultimately generate a micro-isolation policy that can be directly parsed and enforced by the microservice service mesh control plane.

[0042] Furthermore, after issuing the micro-segmentation policy to the service mesh control plane to intercept outbound communication traffic from root cause nodes carrying payloads of intent, it also includes: Within the effective time window, count the number of access denial log entries blocked by the service mesh control plane; If the number of access denied log entries exceeds the preset attack frequency, a baseline update command will be triggered. Based on the baseline update instruction, all directed edge communication features generated by root cause nodes are removed from the full communication span dataset. The remaining communication span data after removal is used to recalculate the baseline mean of the communication message body length, thereby updating the historical normal behavior baseline model.

[0043] In a specific embodiment, after the micro-segmentation policy is issued to the service mesh control plane to intercept outbound communication traffic from the root cause node carrying the intent to transmit, in order to maintain the high purity and dynamic adaptive evolution capability of the underlying security detection model, the system also needs to execute deep baseline self-repair logic. The detailed implementation method is as follows: First, the system uses the telemetry log collection component integrated into the microservice mesh to monitor and synchronously extract the access control feedback records of the security policy execution point in real time. The system uses a time sliding window algorithm to lock the effective time window set in the aforementioned micro-segmentation policy. Within this specific time range, the system aggregates and counts the number of access denial log entries generated after the service mesh control plane performs packet loss actions according to the interception rules. This is to quantify the intensity of the root cause node's activity in continuously initiating abnormal probes or malicious retries after being partially blocked. The system's internal dynamic evaluation engine extracts a pre-set attack frequency threshold for measuring high-concurrency persistent threats. It then compares the actual number of denied access log entries with this threshold. If the result shows that the number of denied access log entries is greater than the preset attack frequency, it means that the root cause node is not in an occasional logical failure state, but has been completely compromised and has become a zombie source that continuously outputs malicious traffic to the internal network. Its recent historical communication data is very likely to have caused hidden "data poisoning" pollution to the system's normal behavior judgment criteria. Based on this, the system immediately triggers and issues a high-level baseline update command containing the root cause node's identifier to the backend security analysis center. Finally, upon receiving the baseline update instruction, the model training service immediately initiates an asynchronous data cleaning pipeline. Utilizing a database query and filtering mechanism, it retrieves data from the full communication span dataset used for model baseline computation based on the root cause node identifier. This forcibly isolates and completely removes all historical call spans originating from that node, along with all corresponding directed edge communication feature data, thoroughly stripping away any potential noise. Subsequently, the system uses the remaining clean and healthy node communication span data after cleaning and removal as a new reference sample. It then calls the underlying statistical algorithm engine to refit and calculate the baseline mean of the communication message body length, objectively reflecting the current normal business practices. This latest calculation result is then used to hot-update and overwrite the original historical normal behavior baseline model. This automated data cleaning and model reshaping mechanism, based on real-world blocking feedback, fundamentally eliminates the security baseline drift risk caused by long-term covert penetration attacks, ensuring that the defense system maintains high-sensitivity anomaly identification accuracy in a dynamically evolving microservice environment.

[0044] Furthermore, after issuing the micro-segmentation policy to the service mesh control plane to intercept outbound communication traffic from root cause nodes carrying payloads of intent, it also includes: When a health inbound call request pointing to the root cause node identifier exists in the microservice communication link, the health inbound call request is intercepted. Query the standby node identifier that belongs to the same microservice cluster as the root cause node identifier; Modify the target network address in the health inbound call request to the network address corresponding to the standby node identifier, and redirect the health inbound call request to be executed in the microservice instance corresponding to the standby node identifier.

[0045] In a specific embodiment, after the micro-segmentation policy is issued to the service mesh control plane to intercept outbound communication traffic from the root cause node carrying the intended payload, in order to ensure the high availability of global services and the self-healing and avalanche prevention capabilities of the communication links, dynamic circuit breaking and redirection routing logic for normal traffic is also included. The detailed implementation is as follows: First, the system continuously monitors global inbound traffic in the network topology. When a healthy inbound call request originating from other normal microservices and clearly targeting the isolated root cause node is detected in real time in the microservice communication link, that is, the request has been confirmed by the preceding security verification mechanism to not carry malicious characteristics and conform to normal business logic, in order to prevent normal business flows from getting stuck in long request timeouts, deadlocks, or even more serious issues due to the target node being in an outbound blocked or abnormal state, the system implements a system for dynamic circuit breaking and redirection routing for normal traffic. This triggers a cascading avalanche effect across the entire chain. At the sidecar proxy level, the system immediately triggers an active interception mechanism to intercept and block the healthy inbound call request before it physically reaches the root cause node. The request is then suspended and temporarily stored in a high-priority memory scheduling queue to await rerouting. Next, the system calls the service registry component interface in the distributed microservice architecture. Using the isolated root cause node identifier as the retrieval key, it reads the global instance status registry of the microservice cluster. By matching the same service name, environment tag, and business version number, it quickly queries and retrieves the backup node identifier that belongs to the same microservice cluster as the root cause node identifier and is currently in a healthy heartbeat state. This allows the system to find a redundant replacement instance with the same business logic processing capabilities. Subsequently, the system selects an optimal backup node identifier from the queried backup list based on built-in dynamic load balancing algorithms such as round-robin or least connections. It then calls the routing rewriting engine at the network protocol layer to directly modify the network layer and application layer headers of the temporarily stored health inbound call request in memory, replacing and overwriting the original physical target network address pointing to the root cause node with the real available network address corresponding to the selected backup node identifier. Finally, the system uses the dynamic routing and forwarding mechanism of the service mesh control plane to smoothly redirect the health inbound call request, which has undergone address rewriting and packet re-encapsulation, to the microservice instance corresponding to the backup node identifier for relay execution and response return. This seamless traffic cutover mechanism based on dynamic address overwriting and service discovery completely cuts off the threat of the damaged root cause node spreading outward, while realizing automated disaster recovery and business self-healing of the internal health communication links of the microservice. This maximizes the macro-robustness and service continuity of the distributed system in the face of local node failures.

[0046] Example 2: Reference Figure 2 A microservice secure communication system, comprising: The node delivery module is used to intercept the initial call request sent by the first node in the microservice communication link, extract the context features of the initial call request to generate the initial intent payload, and inject the initial intent payload and the link tracing identifier into the request header of the initial call request and pass it to the downstream nodes along the microservice communication link. The identifier extraction module is used to extract the target link tracing identifier bound to the security interception event when the tail node of the microservice communication link triggers a security interception event, and pull the full communication span dataset corresponding to the target link tracing identifier. The building module is used to construct a directed acyclic execution graph containing a set of nodes and a set of directed edges using the full communication span dataset. It extracts the communication features of the directed edges and the transmission intent payload from the full communication span dataset and initializes the reception suspicion of all nodes in the directed acyclic execution graph to zero. The backtracking loop module is used to initiate a reverse backtracking loop for a directed acyclic execution graph. The reverse backtracking loop includes: Set the tail node as the current node, extract the directed edge communication features and transmission intention load of the incoming edge corresponding to the current node, calculate the deviation distance between the directed edge communication features and the historical normal behavior baseline model to obtain the basic deviation score, and compare the transmission intention load with the initial intention load to obtain the intention tampering penalty score. The cumulative suspicion of the current node is calculated by summing the base deviation score, the penalty score for attempted tampering, and the reception suspicion of the current node. If the cumulative suspicion of the current node is greater than the preset threshold and the basic deviation score of the incoming edge corresponding to the current node is zero, then exit the reverse backtracking loop and determine the current node as the root cause node. If the cumulative suspicion of the current node is not greater than the preset threshold and the current node has a predecessor node, multiply the cumulative suspicion of the current node by the decay factor to obtain the derived suspicion, assign the derived suspicion to the received suspicion of the predecessor node, update the predecessor node to the current node and continue to execute the reverse backtracking loop. The policy generation module is used to generate micro-segmentation policies based on the root cause node identifier and the transmission intent load of the corresponding outgoing edge of the root cause node, and to send the micro-segmentation policies to the service mesh control plane to intercept outgoing communication traffic of the root cause node carrying the transmission intent load.

Claims

1. A microservice secure communication method, characterized in that, Includes the following steps: Intercept the initial call request sent by the first node in the microservice communication link, extract the context features of the initial call request to generate the initial intent payload, and inject the initial intent payload and the link tracing identifier into the request header of the initial call request and pass it to the downstream nodes along the microservice communication link; When the tail node of the microservice communication link triggers a security interception event, extract the target link tracing identifier bound to the triggering security interception event, and pull the full communication span dataset corresponding to the target link tracing identifier; A directed acyclic execution graph containing a set of nodes and a set of directed edges is constructed using the full communication span dataset. Directed edge communication features and transmission intent payload are extracted from the full communication span dataset. The reception suspicion of all nodes in the directed acyclic execution graph is initialized to zero. A reverse backtracking loop is initiated for the directed acyclic execution graph. The reverse backtracking loop includes: Set the tail node as the current node, extract the directed edge communication features and transmission intention load of the incoming edge corresponding to the current node, calculate the deviation distance between the directed edge communication features and the historical normal behavior baseline model to obtain the basic deviation score, and compare the transmission intention load with the initial intention load to obtain the intention tampering penalty score. The cumulative suspicion of the current node is calculated by summing the base deviation score, the penalty score for attempted tampering, and the reception suspicion of the current node. If the cumulative suspicion of the current node is greater than the preset threshold and the basic deviation score of the incoming edge corresponding to the current node is zero, then exit the reverse backtracking loop and determine the current node as the root cause node. If the cumulative suspicion of the current node is not greater than the preset threshold and the current node has a predecessor node, multiply the cumulative suspicion of the current node by the decay factor to obtain the derived suspicion, assign the derived suspicion to the received suspicion of the predecessor node, update the predecessor node to the current node and continue to execute the reverse backtracking loop. Based on the root cause node identifier and the transmission intent load of the corresponding outgoing edge of the root cause node, a micro-segmentation policy is generated and sent to the service mesh control plane to intercept the outgoing communication traffic of the root cause node carrying the transmission intent load.

2. The microservice secure communication method according to claim 1, characterized in that, Intercept the initial call request sent by the first node in the microservice communication chain, extract the context features of the initial call request to generate the initial intent payload, including: Intercept the initial call request sent by the first node in the sidecar proxy layer of the microservice communication link, and parse the network protocol message of the initial call request; Extract the requester's identity credentials, request action type, and target access path from the network protocol message, and use the set of requester's identity credentials, request action type, and target access path as the context features of the initial call request. The requester's identity credentials, request action type, and target access path in the context features are concatenated in dictionary order to obtain the plaintext intent feature string. Obtain the private signature key pre-allocated by the system for the first node, and use the private signature key to perform encrypted hashing operation on the plaintext feature string of the intent to extract the intent signature digest; The plaintext intent feature string and the intent signature digest are combined and encrypted to generate the initial intent payload.

3. The microservice secure communication method according to claim 1, characterized in that, A directed acyclic execution graph containing a set of nodes and a set of directed edges is constructed using the full communication span dataset. Directed edge communication features and the transmitted intent payload are extracted from the full communication span dataset, including: Extract the caller's network address, the called party's network address, and the time point from the full communication span dataset; A set of directed edges is generated by connecting the network addresses of the caller and the callee in chronological order. After deduplicating the microservice instances corresponding to the network addresses of the caller and the callee, a set of nodes is generated. The set of nodes and the set of directed edges are then combined to form a directed acyclic execution graph. For each directed edge in the set of directed edges, the corresponding communication message body length and parameter type are extracted from the full communication span dataset as directed edge communication features. Parse the communication span request header corresponding to each directed edge, and extract the content of the custom fields carried in the request header as the transmission intent payload.

4. The microservice secure communication method according to claim 3, characterized in that, The baseline deviation score is derived by calculating the deviation distance between the directed edge communication characteristics and the historical normal behavior baseline model, including: Extract the baseline mean of the communication message body length and the valid set of parameter types from the historical normal behavior baseline model; Calculate the absolute difference between the communication message body length and the baseline mean of the communication message body length in the directed edge communication features, and divide the absolute difference by the baseline mean of the communication message body length to obtain the length fluctuation rate; Verify whether the parameter types in the directed edge communication features belong to the valid set of parameter types; If the parameter type belongs to the valid set of parameter types, multiply the length volatility by the basic penalty coefficient to obtain the basic deviation score; If the parameter type does not belong to the valid set of parameter types, the length volatility is multiplied by the penalty amplification factor to obtain the basic deviation score.

5. The microservice secure communication method according to claim 2, characterized in that, The intent tampering penalty is determined by comparing the transmitted intent payload with the initial intent payload, including: The global public key of the sidecar proxy layer is used to decrypt the transmitted intent payload and extract the transmitted intent plaintext and the transmitted signature digest; A comparison signature digest is generated by performing a secondary hash operation on the plaintext of the transmitted intent using a global public key. Verify that the signature digest matches the transmitted signature digest. If there is a discrepancy, it is determined that the transmitted intent payload has been tampered with by a middleman, and the intent tampering penalty is assigned a preset extreme value; If they match, extract the current request action type from the plaintext of the transmitted intent and compare whether the current request action type matches the request action type in the initial intent payload; if they match, assign the intent tampering penalty to zero, otherwise assign the intent tampering penalty to the base tampering value.

6. The microservice secure communication method according to claim 1, characterized in that, The derived suspicion score is obtained by multiplying the cumulative suspicion score of the current node by the decay factor. This derived suspicion score is then assigned to the received suspicion score of the predecessor node, including: Extract the number of incoming edges of the current node in the directed acyclic execution graph; If the number of incoming edges of the current node is equal to one, it is determined that the current node has a unique predecessor node. A preset fixed attenuation constant is extracted as an attenuation factor. The derived attenuation factor obtained by multiplying the cumulative attenuation of the current node by the attenuation factor is directly assigned to the reception attenuation of the unique predecessor node. If the number of incoming edges of the current node is greater than one, it is determined that the current node has multiple concurrent predecessor nodes. The distribution weight is calculated based on the proportion of the communication message body length transmitted by each concurrent predecessor node to the total incoming message body length. The preset fixed attenuation constant is multiplied by the distribution weight as a weighted attenuation factor. The cumulative suspicion of the current node is multiplied by the weighted attenuation factor to obtain the traffic-derived suspicion. The traffic-derived suspicion is assigned to the reception suspicion of the corresponding concurrent predecessor node.

7. The microservice secure communication method according to claim 1, characterized in that, The reverse backtracking loop also includes: If the cumulative suspicion score of the current node is greater than the preset threshold and the basic deviation score of the incoming edge corresponding to the current node is not zero, the current node is marked as a polluted node. Extract the intentional tampering penalty score of the incoming edge corresponding to the contaminated node. If the intentional tampering penalty score is greater than zero, the predecessor node is determined to be the deception initiator. The cumulative suspiciousness of the current node is directly assigned to the reception suspiciousness of the predecessor node without decay, and the predecessor node is updated to the current node to continue the reverse backtracking loop. If the current node has no predecessor node and the cumulative suspicion level of the current node is greater than the preset threshold, the reverse backtracking loop will be broken, and the current node will be determined as the root cause node of the chain head's fall.

8. The microservice secure communication method according to claim 1, characterized in that, Micro-segmentation strategies are generated based on root cause node identifiers and the transmission intent load of the outgoing edges corresponding to the root cause nodes, including: Extract the target access path from the directed edge communication features of the outgoing edges corresponding to the root cause node; The abnormal request action type is obtained by parsing the transmission intent load of the outgoing edge corresponding to the root cause node. Generate a five-tuple isolation rule by concatenating the root cause node identifier, the target access path, and the abnormal request action type; Define the effective time window and interception action identifier for the five-tuple isolation rule, and encapsulate the five-tuple isolation rule, effective time window, and interception action identifier into a micro-isolation policy.

9. The microservice secure communication method according to claim 8, characterized in that, After issuing the micro-segmentation policy to the service mesh control plane to intercept outbound communication traffic from root cause nodes carrying payloads with delivery intent, the following steps are also included: Within the effective time window, count the number of access denial log entries blocked by the service mesh control plane; If the number of access denied log entries exceeds the preset attack frequency, a baseline update command will be triggered. Based on the baseline update instruction, all directed edge communication features generated by root cause nodes are removed from the full communication span dataset. The remaining communication span data after removal is used to recalculate the baseline mean of the communication message body length, thereby updating the historical normal behavior baseline model.

10. A microservice secure communication system, characterized in that, It is implemented based on any one of the microservice secure communication methods described in claims 1-9, and includes: The node delivery module is used to intercept the initial call request sent by the first node in the microservice communication link, extract the context features of the initial call request to generate the initial intent payload, and inject the initial intent payload and the link tracing identifier into the request header of the initial call request and pass it to the downstream nodes along the microservice communication link. The identifier extraction module is used to extract the target link tracing identifier bound to the security interception event when the tail node of the microservice communication link triggers a security interception event, and pull the full communication span dataset corresponding to the target link tracing identifier. The building module is used to construct a directed acyclic execution graph containing a set of nodes and a set of directed edges using the full communication span dataset. It extracts the communication features of the directed edges and the transmission intent payload from the full communication span dataset and initializes the reception suspicion of all nodes in the directed acyclic execution graph to zero. The backtracking loop module is used to initiate a reverse backtracking loop for a directed acyclic execution graph. The reverse backtracking loop includes: setting the tail node as the current node; extracting the directed edge communication features and transmission intent payload of the incoming edge corresponding to the current node; calculating the deviation distance between the directed edge communication features and the historical normal behavior baseline model to obtain the basic deviation score; comparing the transmission intent payload with the initial intent payload to obtain the intent tampering penalty score; summing the basic deviation score, intent tampering penalty score, and the current node's reception suspicion score to obtain the current node's cumulative suspicion score; if the current node's cumulative suspicion score is greater than a preset threshold and the basic deviation score of the incoming edge corresponding to the current node is zero, then exiting the reverse backtracking loop and determining the current node as the root cause node; if the current node's cumulative suspicion score is not greater than a preset threshold and the current node has a predecessor node, multiplying the current node's cumulative suspicion score by a decay factor to obtain the derived suspicion score; assigning the derived suspicion score to the predecessor node's reception suspicion score; updating the predecessor node as the current node and continuing to execute the reverse backtracking loop. The policy generation module is used to generate micro-segmentation policies based on the root cause node identifier and the transmission intent load of the corresponding outgoing edge of the root cause node, and to send the micro-segmentation policies to the service mesh control plane to intercept outgoing communication traffic of the root cause node carrying the transmission intent load.

Images