Cloud security situation awareness method and system based on multi-dimensional data fusion

Abstract

The application relates to the technical field of cloud security, and discloses a cloud security situation awareness method and system based on multi-dimensional data fusion, which comprises the following steps: based on preset initial weights of each dimension, weighting and fusing a multi-dimensional situation feature vector set in a cloud environment to obtain an encrypted security situation feature vector; performing a ciphertext situation evaluation operation on a homomorphic encryption situation feature vector obtained through a homomorphic encryption technology and a cryptology evaluation benchmark parameter to generate a ciphertext situation evaluation result; decrypting the ciphertext situation evaluation result and calculating the cryptology contribution degree of each dimension of the plaintext situation evaluation result obtained through decryption; proportionally adjusting the initial weights of each dimension to generate a fusion weight; and outputting, as a situation awareness result, the encryption communication comprehensive security level determined according to the plaintext situation evaluation result, the cryptology contribution degree and the fusion weight; and the application can improve the efficiency of cloud security situation awareness based on multi-dimensional data fusion.

Description

Technical Field

[0001] This invention relates to the field of cloud security technology, and in particular to a cloud security situation awareness method and system based on multi-dimensional data fusion. Background Technology

[0002] Cloud computing environments carry massive amounts of business communication data. Cloud security situation awareness relies on multi-dimensional cryptographic data such as key status and channel topology to complete risk assessment. Multi-dimensional feature fusion and ciphertext domain security assessment are the core links to ensure the privacy of cloud communication data and the credibility of situation assessment. The weight allocation mechanism directly determines the degree of influence of each security dimension on the overall situation result, and is the key foundation for achieving accurate security classification and risk handling.

[0003] Existing cloud security situational awareness solutions mostly employ plaintext data fusion and evaluation operations. In the multi-dimensional feature weighting stage, they use only fixed initial weights to complete feature concatenation, failing to dynamically adjust weights based on the actual security risks of each dimension. Furthermore, the entire situational assessment process is unprotected by homomorphic encryption; raw cryptographic features and baseline parameters are used in plaintext for calculation. This not only risks the leakage of sensitive cryptographic data from cloud communication nodes but also makes it impossible to quantify the contribution of each security indicator to the overall situational awareness. Consequently, comprehensive security level determination lacks reliable data support, resulting in low overall computational efficiency and evaluation accuracy for situational awareness, failing to meet the dual requirements of privacy and security and accurate risk warning in high-density cloud communication scenarios. Therefore, improving the efficiency of cloud security situational awareness based on multi-dimensional data fusion has become an urgent problem to be solved. Summary of the Invention

[0004] This invention provides a cloud security situation awareness method and system based on multi-dimensional data fusion to solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides a cloud security situation awareness method based on multi-dimensional data fusion, comprising: Z1. Based on the preset initial weights of each dimension, the multi-dimensional situational feature vector set of communication nodes in the cloud environment is weighted and fused to obtain the encryption security situational feature vector of the cloud environment. Z2. Perform a ciphertext status assessment operation on the homomorphic encryption status feature vector obtained by homomorphic encryption technology and the cryptographic assessment benchmark parameters in the cloud environment to generate the ciphertext status assessment result of the cloud environment. Z3. Decrypt the ciphertext situation assessment results and calculate the cryptographic contribution of the plaintext situation assessment results obtained after decryption for each dimension. Z4. Based on the correspondence between the cryptographic contribution and the initial weight, the initial weight of each dimension is proportionally adjusted to generate the fusion weight of the cloud environment. The comprehensive security level of encrypted communication determined according to the plaintext situation assessment result, the cryptographic contribution, and the fusion weight are output as the situation awareness result of the cloud environment.

[0006] To address the aforementioned problems, this invention also provides a cloud security situation awareness system based on multi-dimensional data fusion, the system comprising: The feature fusion module is used to perform weighted fusion of the multi-dimensional situation feature vector set of communication nodes in the cloud environment based on the preset initial weights of each dimension, so as to obtain the encryption security situation feature vector of the cloud environment. The ciphertext evaluation module is used to perform ciphertext status evaluation operations on the homomorphic encryption status feature vector obtained by homomorphic encryption technology and the cryptographic evaluation benchmark parameters in the cloud environment to generate the ciphertext status evaluation result of the cloud environment. The contribution calculation module is used to decrypt the ciphertext situation assessment result and calculate the cryptographic contribution of the plaintext situation assessment result obtained after decryption in each dimension. The weight output module is used to adjust the initial weights of each dimension proportionally according to the correspondence between the cryptographic contribution and the initial weights, generate the fusion weights of the cloud environment, and output the overall security level of encrypted communication determined according to the plaintext situation assessment results, the cryptographic contribution, and the fusion weights as the situation awareness results of the cloud environment.

[0007] Compared with the prior art, the present invention has the following beneficial effects: 1. This invention employs homomorphic encryption throughout the entire process to perform ciphertext field operations on situation features and baseline parameters. All cryptographically related raw data and evaluation calculations are transmitted in ciphertext form, which can fully protect sensitive cryptographic data of communication nodes in the cloud environment and eliminate the risk of leakage caused by plaintext data participating in the calculation. At the same time, relying on vector order concatenation, ciphertext verification, and hash integrity verification mechanisms, it ensures the data integrity of multidimensional situation data throughout the fusion and evaluation process, and improves the data security assurance capability of the situation assessment process.

[0008] 2. This invention dynamically adjusts dimensional weights by quantifying the cryptographic contribution of each dimension, accurately calculates the risk impact ratio of a single dimension based on a standardized normalization formula, and generates fusion weights by adaptively matching the initial weights based on the contribution, thereby achieving dynamic adaptation of multi-dimensional security indicators. It outputs three complete perception data: the comprehensive security level of encrypted communication, dimensional contribution, and fusion weights, which can directly drive key update and encrypted channel renegotiation instructions, simultaneously improving the computational efficiency, assessment accuracy, and risk response capabilities of cloud security situation awareness. Attached Figure Description

[0009] Figure 1 This is a flowchart illustrating a cloud security situation awareness method based on multi-dimensional data fusion, provided in an embodiment of the present invention. Figure 2 This is a functional block diagram of a cloud security situation awareness system based on multi-dimensional data fusion, provided in an embodiment of the present invention.

[0010] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0011] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0012] This application provides a cloud security situation awareness method based on multi-dimensional data fusion. The executing entity of the cloud security situation awareness method based on multi-dimensional data fusion includes, but is not limited to, at least one of the electronic devices that can be configured to execute the method provided in this application, such as a server and a terminal. In other words, the cloud security situation awareness method based on multi-dimensional data fusion can be executed by software or hardware installed on a terminal device or a server device. The server includes, but is not limited to, a single server, a server cluster, a cloud server, or a cloud server cluster. The server can be an independent server or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0013] Reference Figure 1 The diagram shown is a flowchart illustrating a cloud security situation awareness method based on multi-dimensional data fusion according to an embodiment of the present invention. In this embodiment, the cloud security situation awareness method based on multi-dimensional data fusion includes: Z1. Based on the preset initial weights of each dimension, the multi-dimensional situational feature vector set of communication nodes in the cloud environment is weighted and fused to obtain the encryption security situational feature vector of the cloud environment. In practice, before weighting and fusing the multidimensional situation feature vector set based on the preset initial weights of each dimension, it is necessary to obtain the cryptographic situation dataset related to encrypted communication from each communication node in the cloud environment, and complete the construction and weighting of the multidimensional situation feature vector.

[0014] The cryptographic situation dataset is generated periodically by key management agents, encryption channel monitoring agents, and certificate status collection agents on each communication node. The collection period is preferably 30 to 60 seconds. This period can achieve a good balance between the real-time nature of situational awareness and the communication load of the cloud environment, and can be set by those skilled in the art according to the business scale and security level requirements of the cloud environment.

[0015] The cryptographic situation dataset includes at least four types of cryptographic situation features: key state dimension, channel topology dimension, encryption protocol dimension, and certificate validity period dimension. Specifically, the key state dimension includes parameters such as remaining key validity time, key rotation interval, and key algorithm strength level; the channel topology dimension includes parameters such as the number of encrypted channel connections, the number of abnormal connection drops, and the channel encryption suite negotiation results; the encryption protocol dimension includes parameters such as the currently enabled transport layer security protocol version, symmetric encryption algorithm type, and key exchange algorithm type; and the certificate validity period dimension includes parameters such as the remaining valid days of the digital certificate, certificate chain integrity identifier, and certificate revocation status identifier.

[0016] Regarding the construction method of the multidimensional situation feature vector set, in some embodiments, this application preferably maps the cryptographic situation features of each dimension in the cryptographic situation dataset to a fixed-length situation feature vector according to the feature dimension order of the cryptographic situation dataset, and assigns a dimension index to each dimension according to the feature dimension order to generate the multidimensional situation feature vector set of the cloud environment.

[0017] Specifically, the length of the situation feature vector for each dimension is set to 16 dimensions, which achieves a good balance between feature representation capability and subsequent homomorphic encryption computation overhead. For the key state dimension, the remaining valid key time is normalized to the maximum validity period of 86,400 seconds and mapped to the first element of the vector; the key rotation interval is normalized to the maximum rotation period of 604,800 seconds and mapped to the second element of the vector; the key algorithm strength level is encoded as a floating-point value between 0 and 1 according to a preset strength level table and mapped to the third element of the vector; the remaining element positions are filled with zero vectors. For the channel topology dimension, encryption protocol dimension, and certificate validity period dimension, the same normalization mapping rule is used to write each original parameter sequentially into the corresponding element position of the situation feature vector of the corresponding dimension.

[0018] The dimension indices are assigned sequentially according to the feature dimensions, with the key state dimension index being 0, the channel topology dimension index being 1, the encryption protocol dimension index being 2, and the certificate validity period dimension index being 3. This forms a multi-dimensional situation feature vector set containing 4 dimensions and 16 features in each dimension.

[0019] In some embodiments, the initial weights of each dimension are preferably preset and allocated according to the degree of influence of each dimension on the overall encrypted communication security of the cloud environment.

[0020] Specifically, the initial weights for the key state dimension are set to 0.35, the channel topology dimension to 0.30, the encryption protocol dimension to 0.20, and the certificate validity period dimension to 0.15. The basis for this initial weight allocation is as follows: key state directly determines the confidentiality of encrypted data and has the greatest impact on the overall security posture; channel topology reflects the real-time connectivity and abnormal conditions of the encrypted communication link, and its impact is secondary; encryption protocol and certificate validity period, as auxiliary security indicators, have relatively low weights. The above initial weights satisfy the normalization constraint that the sum of the weights of each dimension equals 1.

[0021] The situation feature vectors of each dimension are matched and associated with the preset initial weights of the corresponding dimensions to obtain the weighted situation feature vectors of each dimension in the cloud environment.

[0022] Specifically, for any dimension of situation feature vector, it is scaled by scalar weights with the initial weights of the corresponding dimension to obtain the weighted situation feature vector of that dimension. That is, each element in the weighted situation feature vector is equal to the product of the corresponding element of the situation feature vector of that dimension and the initial weights.

[0023] According to the order of the dimension indexes, the weighted situation feature vectors of each dimension are concatenated to generate the encrypted security situation feature vector of the cloud environment.

[0024] Specifically, following the order of dimension indices 0, 1, 2, and 3, the 16-dimensional weighted situation feature vectors of each dimension are concatenated end to end to generate a 64-dimensional encryption security situation feature vector. Among them, the weighted situation feature vector of the key state dimension occupies index positions 0 to 15, the weighted situation feature vector of the channel topology dimension occupies index positions 16 to 31, the weighted situation feature vector of the encryption protocol dimension occupies index positions 32 to 47, and the weighted situation feature vector of the certificate validity period dimension occupies index positions 48 to 63.

[0025] By connecting the above vector order positions, the multidimensional cryptographic situation features are organized into a single feature vector according to a unified indexing standard, providing structured data input for subsequent homomorphic encryption and ciphertext field evaluation, while retaining the order information of each dimension so that they can be paired according to the dimension index during the evaluation stage.

[0026] Z2. The homomorphic encryption status feature vector obtained by homomorphic encryption technology is obtained by comparing the encryption security status feature vector with the cryptographic evaluation benchmark parameters in the cloud environment to perform ciphertext status evaluation and generate the ciphertext status evaluation result of the cloud environment. In practice, the ciphertext situation assessment includes four stages: construction of homomorphic encryption key pairs, homomorphic encryption of situation feature vectors, construction of cryptographic assessment benchmark parameters, and homomorphic assessment within the ciphertext domain.

[0027] In some embodiments, the construction of homomorphic encryption key pairs preferably involves constructing a homomorphic encryption public key and a homomorphic encryption private key based on the homomorphic encryption configuration parameters of the cryptographic situation dataset, and pairing them to form a homomorphic encryption key pair.

[0028] Specifically, the homomorphic encryption configuration parameters include a homomorphic encryption algorithm type identifier, a key length parameter, a noise budget parameter, and a verification base ciphertext. In this embodiment, the homomorphic encryption algorithm type identifier is set to a fully homomorphic encryption scheme that supports both additive and comparison homomorphic operations, the key length parameter is set to 2048 bits, and the noise budget parameter is set to 60 bits. The reason for selecting this fully homomorphic encryption scheme is that cloud security posture assessment requires the execution of two types of homomorphic operations: ciphertext subtraction and ciphertext comparison. This scheme can support both types of operations simultaneously in the integer field, and the 2048-bit key length achieves a good balance between security strength and computational efficiency.

[0029] Based on the above configuration parameters, the key generation function of the homomorphic encryption algorithm is called to generate a homomorphic encryption public key and a homomorphic encryption private key, and then paired to form a homomorphic encryption key pair.

[0030] In some embodiments, the homomorphic encryption of the situation feature vector is preferably performed by mapping each situation feature component in the encrypted security situation feature vector to a homomorphic ciphertext component based on the homomorphic encryption public key, and then sequentially connecting them to form the homomorphic encrypted situation feature vector of the cloud environment.

[0031] Specifically, for each status feature component in the encrypted security status feature vector with index positions from 0 to 63, the public-key homomorphic encryption function is called to encrypt it into the corresponding homomorphic ciphertext component. The 64 homomorphic ciphertext components are then arranged sequentially according to index positions 0 to 63 to form the homomorphic encrypted status feature vector.

[0032] In some embodiments, the construction of cryptographic evaluation benchmark parameters preferably involves classifying and labeling the state benchmark parameters of the cryptographic state dataset according to the evaluation dimensions corresponding to the dimension index, thereby obtaining the cryptographic evaluation benchmark parameter set for the cloud environment, and further performing public-key homomorphic encryption to obtain the cryptographic evaluation benchmark parameters.

[0033] Specifically, situation baseline parameters for each dimension are retrieved from the cloud environment security management policy library and categorized according to the evaluation dimensions: the key status evaluation dimension corresponds to the baseline values ​​for the remaining valid key time, key rotation interval, and key algorithm strength; the channel security evaluation dimension corresponds to the baseline values ​​for the maximum number of encrypted channel connections, the threshold for abnormal disconnections, and the minimum strength of the encryption suite. After arranging each situation baseline parameter into a dimension baseline sub-vector according to the same ordinal rule as the dimension index, homomorphic encryption is performed on each parameter based on the homomorphic public key to obtain the cryptographic evaluation baseline parameters. The ciphertext component at each index position corresponds to the situation baseline component value at that position after homomorphic encryption with the public key.

[0034] In some embodiments, the homomorphic evaluation within the ciphertext domain preferably involves establishing a pairing relationship between the cryptographic evaluation benchmark parameters and the ciphertext components at the same index position in the homomorphic encryption situation feature vector according to the dimension index within the ciphertext domain, and performing ciphertext homomorphic evaluation on the paired ciphertext component pairs to generate the ciphertext situation evaluation result of the cloud environment.

[0035] Specifically, the ciphertext homomorphic evaluation is performed in two sub-stages: key state evaluation and channel security evaluation. The key-time ciphertext features of the cryptographic evaluation benchmark parameters are arranged according to the time-series dimension to obtain the key-state ciphertext benchmark vector of the cloud environment; the channel-topology ciphertext features of the cryptographic evaluation benchmark parameters are arranged according to the topology dimension to obtain the channel-security ciphertext benchmark vector of the cloud environment.

[0036] Within the ciphertext domain, each ciphertext component in the key state ciphertext base vector is paired with the homomorphic ciphertext component in the same position of the homomorphic encryption state feature vector to form ciphertext component pairs. Homomorphic subtraction is then performed on each ciphertext component pair to obtain the key state ciphertext evaluation component. This component represents the ciphertext difference between the actual key state and the base key state at the corresponding position. All 16 key state ciphertext evaluation components are arranged sequentially to obtain the complete key state ciphertext evaluation component sequence.

[0037] Within the ciphertext domain, each ciphertext component in the channel security ciphertext baseline vector is paired with the corresponding homomorphic ciphertext component in the topologically corresponding position of the homomorphic encryption situation feature vector. A homomorphic comparison is performed on each pair, and the comparison result ciphertext is used as the channel security ciphertext evaluation component. When the actual channel security feature is not lower than the baseline value, the comparison result ciphertext corresponds to an encryption result with a logical truth value of 1; otherwise, it corresponds to an encryption result with a logical false value of 0. All 16 ciphertext evaluation components are arranged sequentially to obtain the complete channel security ciphertext evaluation component sequence.

[0038] Before performing vector concatenation of the key state ciphertext evaluation component and the channel security ciphertext evaluation component according to the index order of the evaluation dimensions, in some embodiments of this application, preferably, ciphertext check value calculation and integrity protection are performed on the key state ciphertext evaluation component and the channel security ciphertext evaluation component respectively.

[0039] Specifically, ciphertext check values ​​are calculated for the key state ciphertext evaluation component and the channel security ciphertext evaluation component, respectively. The ciphertext check value calculation adopts a hash check method that can be executed within the ciphertext field. The ciphertext check value of the key state ciphertext evaluation component is compared with the verification base ciphertext in the homomorphic encryption configuration parameters to perform a homomorphic equality check. When the check result is true, the key state ciphertext evaluation component is retained as the key state check component. The same check is performed on the channel security ciphertext evaluation component to obtain the channel security check component.

[0040] Based on the index order of the evaluation dimension, the key state verification component and the channel security verification component are aligned in terms of component structure to obtain an aligned evaluation component set, in which the first 16 components are taken from the key state verification component and the last 16 components are taken from the channel security verification component.

[0041] The homomorphic ciphertext components corresponding to each evaluation dimension in the alignment evaluation component set are padded with ordinal positions. The corresponding positions of the encryption protocol dimension and certificate validity period dimension that did not participate in the evaluation are filled with zero ciphertext to obtain the spliced ​​evaluation vector. The total length is kept at 64 dimensions to be consistent with the structure of the encryption security situation feature vector.

[0042] A secure hash algorithm is used to hash the ciphertext sequence of the concatenated evaluation vector, generating a 256-bit fixed-length hash value as a ciphertext integrity check code.

[0043] The ciphertext integrity check code is appended to the end of the concatenated evaluation vector to generate the ciphertext situation assessment result.

[0044] Through the above-described ciphertext domain evaluation process, the comparison and calculation of situation characteristics and benchmark parameters are completed entirely in ciphertext. The original cryptographic situation data of the cloud environment communication nodes does not need to be used in plaintext for evaluation, effectively protecting sensitive cryptographic information. At the same time, the ciphertext verification and hash integrity verification mechanisms ensure the integrity of the evaluation data during transmission and calculation.

[0045] Z3. Decrypt the ciphertext situation assessment results and calculate the cryptographic contribution of the plaintext situation assessment results obtained after decryption for each dimension. In practice, the calculation of the cryptographic contribution includes three stages: ciphertext decryption, situation feature comparison, and normalized contribution conversion.

[0046] In some embodiments, the ciphertext decryption process preferably involves using a homomorphic encryption private key to perform homomorphic decryption on each component of the spliced ​​evaluation vector in the ciphertext situation assessment result, thereby obtaining the plaintext situation assessment result.

[0047] The situation assessment feature vectors for each dimension are extracted from the plaintext situation assessment results. These feature vectors are then grouped and merged according to their dimensions to obtain the situation assessment feature vectors for each dimension. Specifically, the plaintext situation assessment results are divided into four groups according to their dimension indices: index positions 0 to 15 correspond to the situation assessment feature vectors for the key state dimension; index positions 16 to 31 correspond to the situation assessment feature vectors for the channel topology dimension; index positions 32 to 47 correspond to the situation assessment feature vectors for the encryption protocol dimension; and index positions 48 to 63 correspond to the situation assessment feature vectors for the certificate validity period dimension.

[0048] In some embodiments, the situation feature comparison is preferably performed by comparing the situation assessment feature vectors of each dimension with the original situation feature vectors of the same dimension in the multi-dimensional situation feature vector set to obtain the situation feature comparison result.

[0049] Specifically, for any dimension, the situation assessment feature vector of that dimension is subtracted element-wise from the original situation feature vector of the same dimension in the multi-dimensional situation feature vector set, according to the same element index position, to obtain the situation feature comparison result for that dimension. The arithmetic mean of the absolute values ​​of all elements in the situation feature comparison result for that dimension is taken as the situation feature correlation value for that dimension. The larger the situation feature correlation value, the greater the deviation between the actual security state and the baseline state for that dimension, and the greater the risk impact of that dimension on the overall security situation.

[0050] In some embodiments, the calculation of cryptographic contribution is preferably performed by scaling the associated values ​​of the situation features in the situation feature comparison results of each dimension based on the initial weights, and then performing normalized proportion conversion on the weight scaling results of each dimension to obtain the cryptographic contribution.

[0051] Specifically, the situation feature correlation values ​​of each dimension are matched and paired with the initial weights of the corresponding dimensions to obtain a set of weight correlation parameters.

[0052] The situation feature correlation value in the weight correlation parameter is scaled with the initial weight of the corresponding dimension to obtain the weighted situation feature value of each dimension. That is, the weighted situation feature value of each dimension is equal to the product of the situation feature correlation value of that dimension and the corresponding initial weight.

[0053] The weighted situation feature values ​​of all dimensions are summed to obtain the total weighted situation feature value.

[0054] The cryptographic contribution of each dimension is obtained by dividing the weighted situation feature value of each dimension by the total weighted situation feature value. Specifically, the cryptographic contribution of a certain dimension is equal to the product of the situation feature correlation value of that dimension and its corresponding initial weight, divided by the sum of the products of the situation feature correlation values ​​of all dimensions and their corresponding initial weights. In this embodiment, the total number of security situation dimensions in the cloud environment is 4.

[0055] Through the above normalization calculation, the sum of the cryptographic contributions of each dimension equals 1. The value range of the cryptographic contribution of each dimension is 0 to 1, which can intuitively reflect the risk contribution ratio of each security dimension to the overall encrypted communication situation, and provide a quantitative basis for subsequent dynamic weight adjustment.

[0056] Z4. Based on the correspondence between the cryptographic contribution and the initial weight, the initial weight of each dimension is proportionally adjusted to generate the fusion weight of the cloud environment. The comprehensive security level of encrypted communication determined according to the plaintext situation assessment result, the cryptographic contribution, and the fusion weight are output as the situation awareness result of the cloud environment.

[0057] In practice, the situational awareness result output includes three stages: generating fusion weights, determining the overall security level of encrypted communication, and encapsulating and outputting situational awareness result data packets.

[0058] In some embodiments, the generation of fusion weights preferably involves matching the cryptographic contribution with the initial weights one by one, and adjusting the associated parameters according to the weights to perform weight scaling and dimension weight allocation on the initial weights.

[0059] Specifically, the cryptographic contribution of each dimension is matched one by one with the initial weight of the corresponding dimension according to the same dimension index to obtain the set of weight adjustment related parameters.

[0060] The correlation parameters are adjusted according to the weights, and the initial weights of each dimension are scaled. The scaled weight is equal to the product of the initial weight of the dimension and the sum of the cryptographic contribution of the dimension. This scaling rule allows dimensions with higher cryptographic contributions to receive a larger weight adjustment range, thereby strengthening the weights of high-risk dimensions.

[0061] The weight scaling results for each dimension are applied according to their relative proportion in all dimensions to obtain the fusion weight. That is, the fusion weight of each dimension is equal to the scaled weight of that dimension divided by the sum of the scaled weights of all dimensions. The fusion weight satisfies the normalization constraint that the sum of the fusion weights of all dimensions equals 1, and can be dynamically adjusted according to the actual security risk contribution of each dimension, overcoming the defect that fixed initial weights cannot adapt to changes in the situation.

[0062] In some embodiments, the determination of the overall security level of encrypted communication preferably involves performing a range attribution determination between the security status score of the plaintext status assessment result and the security level threshold range of the cryptographic status data.

[0063] Specifically, the overall security status score of the cloud environment is calculated based on the plaintext situation assessment results. This score is equal to the weighted average of the feature vector values ​​of each dimension of the situation assessment, and the weights used are fusion weights. The preset security level threshold ranges are as follows: when the security status score is greater than or equal to 0.85, the security level is Level 1; when the security status score is greater than or equal to 0.70 and less than 0.85, the security level is Level 2; when the security status score is greater than or equal to 0.50 and less than 0.70, the security level is Level 3; and when the security status score is less than 0.50, the security level is Level 4.

[0064] From the plaintext situation assessment results, the security situation score of each node is read node by node according to its communication node identifier. The aforementioned interval assignment judgment is then performed on each node's security situation score to determine the corresponding security level. The minimum security level is selected for each node, and the result is used as the overall security level for encrypted communication in the cloud environment. The reason for adopting the minimum selection strategy is that a decrease in the security level of any communication node in the cloud environment may constitute an overall security risk; using the lowest node security level as the overall security level ensures the conservatism and reliability of the risk assessment.

[0065] In some embodiments, the encapsulation and output of situational awareness result data packets preferably involves associating and encapsulating the encrypted communication security level, cryptographic contribution, and fusion weight before outputting the data, and triggering a handling instruction based on the security level.

[0066] Specifically, the overall security level of encrypted communication is written into the security level field slot of the situational awareness result data packet, the cryptographic contributions of the four dimensions are written into the contribution field slot, and the fusion weights of the four dimensions are written into the weight field slot, thus generating the situational awareness result data packet. The situational awareness result data packet is encapsulated in a structured data exchange format and includes a timestamp field, a cloud environment identifier field, a security level field, a contribution array field, and a fusion weight array field.

[0067] The situation awareness result data packet is output to the situation display module and situation handling module of the cloud security management platform. When the overall security level of encrypted communication is level four, a key update command is sent to the key management module, triggering a forced key rotation of all communication nodes in the cloud environment; when the overall security level of encrypted communication is level three, an encrypted channel renegotiation command is sent to the channel management module, triggering a renegotiation of the encryption suite for abnormal channels; when the security level is level one or two, only the situation log is recorded, and no active handling is triggered.

[0068] Through the aforementioned situational awareness result output mechanism, this invention can simultaneously output three types of complete awareness data: security level, dimensional contribution, and fusion weight. This provides cloud security managers with interpretable situational assessment data and drives automated risk handling actions such as key updates and channel renegotiation.

[0069] In one feasible implementation, the mapping of the situation feature vector in Z1 of the above embodiment can also adopt the minimum-maximum normalization method.

[0070] Specifically, for any original cryptographic situational feature parameter in any dimension, a minimum-maximum normalization mapping is performed based on the parameter's historical minimum and maximum values. That is, the normalization result equals the original parameter value minus the historical minimum value, divided by the difference between the historical maximum and minimum values. The normalization result is then written into the corresponding element position of the situational feature vector. This method can adapt to different parameters' dimensions and value ranges, making it suitable for scenarios in cloud environments where the cryptographic situational parameter values ​​reported by various communication nodes vary significantly.

[0071] In one feasible implementation, in the Z2 of the above embodiments, the homomorphic encryption algorithm can also adopt an additive homomorphic encryption scheme.

[0072] Specifically, the algorithm type identifier in the homomorphic encryption configuration parameters is set to an additive homomorphic encryption scheme, and the key length is set to 2048 bits. The additive homomorphic encryption scheme supports both additive homomorphism and scalar weight scaling homomorphism within the ciphertext domain, making it suitable for key state assessment scenarios that only require ciphertext subtraction. For channel security assessments requiring ciphertext comparison, decryption permissions can be restricted to the security posture assessment server after ciphertext subtraction. The server performs the comparison and judgment in a controlled environment and then re-encrypts the comparison result, thus indirectly implementing the channel security assessment function under the additive homomorphic encryption scheme. The advantage of this approach is that the additive homomorphic encryption scheme is mature and widely deployed, making it suitable for cloud environments where ciphertext comparison performance requirements are not high but system compatibility requirements are high.

[0073] In one feasible implementation, in the Z2 of the above embodiment, the ciphertext integrity verification can also adopt the message authentication code method.

[0074] Specifically, during the homomorphic encryption key pair generation phase, a message authentication key is generated synchronously. A message authentication code is calculated for the concatenated evaluation vector, and this code is appended to the end of the concatenated evaluation vector, replacing the secure hash digest value. Before decryption, the receiving end recalculates the message authentication code using the same message authentication key and compares it with the appended code. Subsequent decryption is only performed if the comparison matches. This method provides source authentication capabilities while ensuring data integrity, making it suitable for scenarios where situation assessment data needs to be transmitted across security domains.

[0075] In one feasible implementation, the situation feature correlation value Z3 in the above embodiment can also be calculated using weighted Euclidean distance.

[0076] Specifically, for any dimension, the weighted Euclidean distance between the situation assessment feature vector and the original situation feature vector is calculated as the situation feature correlation value. The weight coefficient of each feature element is set according to its security sensitivity. For the key state dimension, the weight coefficient for the remaining key validity time element is set to 0.4, the weight coefficient for the key algorithm strength element is set to 0.35, and the remaining weights are evenly distributed among the remaining elements. This method assigns differentiated weights to feature elements with different security sensitivities, enabling a more refined reflection of the impact of different features within each dimension on risk.

[0077] In one feasible implementation, in the Z4 of the above embodiment, the generation of the fusion weight can also adopt an exponential adjustment strategy based on contribution deviation.

[0078] Specifically, the deviation of the cryptographic contribution of each dimension from the average contribution is calculated, i.e., the cryptographic contribution of each dimension is subtracted from the average contribution of all dimensions, where the average contribution equals 1 divided by the total number of dimensions. The adjusted weights are calculated using an exponential function, i.e., the adjusted weights are equal to the initial weights of that dimension multiplied by an exponential function with a base of the natural constant and an exponent equal to the product of the adjustment sensitivity coefficient and the deviation. The adjustment sensitivity coefficient is preferably between 0.5 and 2.0, and is set to 1.0 in this embodiment. The adjusted weights are then normalized to obtain the fused weights. This method provides a more significant adjustment to the weights when the contribution deviation is large, making it suitable for cloud communication scenarios with volatile security situations and a need for rapid response to changes in risk.

[0079] In one feasible implementation, the determination of the overall security level of encrypted communication in Z4 of the above embodiments can also adopt a weighted voting strategy.

[0080] Specifically, the security levels of each communication node are weighted and voted on according to their importance. The importance weight is determined by the proportion of service traffic carried by the node; the higher the traffic proportion, the greater the weight. The security level with the highest weighted vote score is taken as the overall security level of encrypted communication. This method is suitable for scenarios in cloud environments where the service importance of each communication node differs significantly, and a simple minimum value selection strategy is not appropriate.

[0081] In one feasible implementation, in the Z4 of the above embodiment, the output of the situational awareness result data packet can also be transmitted using a remote procedure call protocol.

[0082] like Figure 2The diagram shown is a functional block diagram of a cloud security situation awareness system based on multi-dimensional data fusion provided in an embodiment of the present invention.

[0083] The cloud security situation awareness system 100 based on multi-dimensional data fusion described in this invention can be installed in an electronic device. Depending on the functions implemented, the cloud security situation awareness system 100 based on multi-dimensional data fusion may include a feature fusion module 101, a ciphertext evaluation module 102, a contribution calculation module 103, and a weight output module 104. The module described in this invention can also be referred to as a unit, which refers to a series of computer program segments that can be executed by the processor of an electronic device and can perform a fixed function, and are stored in the memory of the electronic device.

[0084] In this embodiment, the functions of each module / unit are as follows: The feature fusion module 101 is used to perform weighted fusion of the multi-dimensional situation feature vector set of communication nodes in the cloud environment based on the preset initial weights of each dimension, so as to obtain the encryption security situation feature vector of the cloud environment. The ciphertext evaluation module 102 is used to perform a ciphertext status evaluation operation on the homomorphic encryption status feature vector obtained by homomorphic encryption technology and the cryptographic evaluation benchmark parameters in the cloud environment to generate the ciphertext status evaluation result of the cloud environment. The contribution calculation module 103 is used to decrypt the ciphertext situation assessment result and calculate the cryptographic contribution of the plaintext situation assessment result obtained after decryption in each dimension. The weight output module 104 is used to adjust the initial weights of each dimension proportionally according to the correspondence between the cryptographic contribution and the initial weights, generate the fusion weights of the cloud environment, and output the comprehensive security level of encrypted communication determined according to the plaintext situation assessment results, the cryptographic contribution and the fusion weights as the situation awareness results of the cloud environment.

[0085] In the several embodiments provided by this invention, it should be understood that the disclosed methods and systems can be implemented in other ways. For example, the system embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and other division methods may be used in actual implementation.

[0086] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0087] Furthermore, the functional modules in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in the form of hardware plus software functional modules.

[0088] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0089] The embodiments of this application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence is the theory, method, technology, and application system that uses digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results.

[0090] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A cloud security situation awareness method based on multi-dimensional data fusion, characterized in that, The method includes: Z1. Based on the preset initial weights of each dimension, the multi-dimensional situational feature vector set of communication nodes in the cloud environment is weighted and fused to obtain the encryption security situational feature vector of the cloud environment. Z2. Perform a ciphertext status assessment operation on the homomorphic encryption status feature vector obtained by homomorphic encryption technology and the cryptographic assessment benchmark parameters in the cloud environment to generate the ciphertext status assessment result of the cloud environment. Z3. Decrypt the ciphertext situation assessment results and calculate the cryptographic contribution of the plaintext situation assessment results obtained after decryption for each dimension. Z4. Based on the correspondence between the cryptographic contribution and the initial weight, the initial weight of each dimension is proportionally adjusted to generate the fusion weight of the cloud environment. The comprehensive security level of encrypted communication determined according to the plaintext situation assessment result, the cryptographic contribution, and the fusion weight are output as the situation awareness result of the cloud environment.

2. The cloud security situation awareness method based on multi-dimensional data fusion as described in claim 1, characterized in that, The multi-dimensional situational feature vector set of communication nodes in the cloud environment is weighted and fused based on the preset initial weights for each dimension to obtain the encryption security situational feature vector of the cloud environment, including: Obtain cryptographic situation datasets related to encrypted communication from each communication node in the cloud environment; Based on the feature dimension order of the cryptographic situation dataset, the cryptographic situation features of each dimension in the cryptographic situation dataset are mapped to fixed-length situation feature vectors, and dimension indices are assigned to each dimension according to the feature dimension order to generate a multi-dimensional situation feature vector set for the cloud environment. The situation feature vectors of each dimension are matched and associated with the preset initial weights of the corresponding dimensions to obtain the weighted situation feature vectors of each dimension in the cloud environment. According to the order of the dimension indexes, the weighted situation feature vectors of each dimension are concatenated to generate the encrypted security situation feature vector of the cloud environment.

3. The cloud security situation awareness method based on multi-dimensional data fusion as described in claim 2, characterized in that, The step of performing a ciphertext security status assessment operation on the homomorphic encryption status feature vector obtained by homomorphic encryption and the cryptographic assessment benchmark parameters in the cloud environment to generate the ciphertext security status assessment result of the cloud environment includes: Based on the homomorphic encryption configuration parameters of the cryptographic situation dataset, construct a homomorphic encryption public key and a homomorphic encryption private key, and pair them to form a homomorphic encryption key pair; Based on the homomorphic encryption public key, each feature component in the encryption security situation feature vector is mapped to a homomorphic ciphertext component, and then sequentially connected to form the homomorphic encryption situation feature vector of the cloud environment. Based on the evaluation dimensions corresponding to the dimension index, the status benchmark parameters of the cryptographic status dataset are classified and labeled to obtain the cryptographic evaluation benchmark parameter set of the cloud environment. Based on the homomorphic encryption public key, the state benchmark components in the cryptographic evaluation benchmark parameter set are grouped and arranged into dimension benchmark sub-vectors according to the evaluation dimension, and then public key homomorphic encryption is performed to obtain the cryptographic evaluation benchmark parameters of the cloud environment. Within the ciphertext domain, the cryptographic evaluation benchmark parameters are paired with the ciphertext components at the same index position in the homomorphic encryption situation feature vector according to the dimension index. Then, the ciphertext homomorphic evaluation operation is performed on the paired ciphertext component pairs to generate the ciphertext situation evaluation result of the cloud environment.

4. The cloud security situation awareness method based on multi-dimensional data fusion as described in claim 3, characterized in that, Within the ciphertext domain, the cryptographic evaluation benchmark parameters are paired with ciphertext components at the same index position in the homomorphic encryption situation feature vector according to the dimensional index. A homomorphic ciphertext evaluation operation is then performed on the paired ciphertext component pairs to generate the ciphertext situation evaluation result for the cloud environment, including: The key-time ciphertext features of the cryptographic evaluation benchmark parameters are arranged in a time-series dimension to obtain the key-state ciphertext benchmark vector of the cloud environment; The channel topology ciphertext features of the cryptographic evaluation benchmark parameters are arranged according to their topological dimensions to obtain the channel security ciphertext benchmark vector of the cloud environment. Within the ciphertext domain, the key state ciphertext base vector and the homomorphic ciphertext components in the same order of the homomorphic encryption situation feature vector are sequentially combined to form ciphertext component pairs, and homomorphic subtraction is performed on the ciphertext component pairs to obtain the key state ciphertext evaluation components of the cloud environment. Within the ciphertext domain, the channel security ciphertext baseline vector is matched one by one with the homomorphic ciphertext components of the topological corresponding positions in the homomorphic encryption situation feature vector, and a homomorphic comparison is performed on each matching pair. The ciphertext of the comparison result of each position is used as the channel security ciphertext evaluation component of the cloud environment. Following the index order of the evaluation dimensions, the key state ciphertext evaluation component and the channel security ciphertext evaluation component are concatenated by an execution vector to generate the ciphertext situation evaluation result of the cloud environment.

5. The cloud security situation awareness method based on multi-dimensional data fusion as described in claim 4, characterized in that, The step of concatenating the key state ciphertext evaluation component and the channel security ciphertext evaluation component into a vector according to the index order of the evaluation dimensions to generate the ciphertext situation assessment result of the cloud environment includes: The key state ciphertext evaluation component and the channel security ciphertext evaluation component are respectively calculated with ciphertext check values, and the ciphertext check values ​​are compared with the verification base ciphertext in the homomorphic encryption configuration parameters to determine homomorphic equality. When the determination result is true, the key state check component and the channel security check component are obtained respectively. Based on the index order of the evaluation dimensions, the key state verification component and the channel security verification component are aligned in terms of component structure to obtain the aligned evaluation component set of the cloud environment. The homomorphic ciphertext components corresponding to each evaluation dimension in the alignment evaluation component set are padded with ordinal positions to obtain the spliced ​​evaluation vector of the cloud environment. A hash operation is performed on the concatenated evaluation vector to generate a fixed-length hash value as the encrypted integrity check code of the cloud environment; The ciphertext integrity check code is appended to the end of the concatenated evaluation vector to generate the ciphertext situational assessment result of the cloud environment.

6. The cloud security situation awareness method based on multi-dimensional data fusion as described in claim 2, characterized in that, The process of decrypting the ciphertext situation assessment result and calculating the cryptographic contribution of each dimension of the decrypted plaintext situation assessment result includes: The encrypted situation assessment result is decrypted to obtain the plaintext situation assessment result of the cloud environment; Extract situation assessment feature vectors for each dimension from the plaintext situation assessment results, and group and merge the situation assessment feature vectors by dimension to obtain the situation assessment feature vectors for the cloud environment. The situation assessment feature vector is compared with the situation feature vector in the multidimensional situation feature vector set to obtain the situation feature comparison result of the cloud environment. Based on the initial weights, multiplication is performed on the situation feature correlation values ​​in the situation feature comparison results of each dimension, and normalization ratio conversion is performed on the multiplication results of each dimension to obtain the cryptographic contribution of the cloud environment.

7. The cloud security situation awareness method based on multi-dimensional data fusion as described in claim 6, characterized in that, Based on the initial weights, multiplication operations are performed on the situation feature correlation values ​​in the situation feature comparison results of each dimension, and normalization ratio conversion is performed on the multiplication results of each dimension to obtain the cryptographic contribution of the cloud environment, including: The situation feature correlation values ​​in the situation feature comparison results of each dimension are matched and paired with the initial weights of the corresponding dimensions to obtain the weight correlation parameters of the cloud environment. The situation feature association value in the weight association parameter is multiplied with the initial weight of the corresponding dimension to obtain the weighted situation feature value of the cloud environment; The weighted situation feature values ​​are summed to obtain the total weighted situation feature value of the cloud environment; The weighted situation feature values ​​of each dimension are normalized by division with the total weighted situation feature value to obtain the cryptographic contribution of each dimension in the cloud environment. The calculation formula for the cryptographic contribution is as follows: ； In the formula, For the first The cryptographic contribution corresponding to the dimension For the first The situation feature correlation value corresponding to the dimension For the first The initial weights of the dimension, This represents the total number of dimensions of the security posture in the cloud environment. To sum and iterate through the virtual index variable.

8. The cloud security situation awareness method based on multi-dimensional data fusion as described in claim 2, characterized in that, The process involves adjusting the initial weights of each dimension proportionally based on the correspondence between the cryptographic contribution and the initial weights to generate a fusion weight for the cloud environment. The overall security level of encrypted communication determined based on the plaintext situation assessment results, the cryptographic contribution, and the fusion weights are then output as the situational awareness results for the cloud environment. This includes: The cryptographic contribution is matched one by one with the initial weight to obtain the weight adjustment correlation parameters for each dimension in the cloud environment; The correlation parameters are adjusted according to the weights, the initial weights are scaled, and the scaling results of each dimension are weighted according to their relative proportion in all dimensions to obtain the fusion weight of the cloud environment. The overall security level of encrypted communication determined based on the plaintext situation assessment results, the cryptographic contribution, and the fusion weight will be output as the situation awareness results of the cloud environment.

9. The cloud security situation awareness method based on multi-dimensional data fusion as described in claim 8, characterized in that, The step of outputting the overall security level of encrypted communication determined based on the plaintext situation assessment results, the cryptographic contribution, and the fusion weight as the situation awareness results of the cloud environment includes: The security status score of the plaintext situation assessment result is sequentially assigned to the upper and lower bounds of the security level threshold range in the cryptographic situation dataset to determine the security level of each node. The minimum value of the security level of each node is selected, and the selection result is used as the comprehensive security level of encrypted communication in the cloud environment. The encrypted communication security level, the cryptographic contribution, and the fusion weight are associated and encapsulated to obtain the situational awareness result data packet of the cloud environment; Output the situational awareness result data packet, and trigger a key update command or an encrypted channel renegotiation command based on the overall security level of the encrypted communication.

10. A cloud security situation awareness system based on multi-dimensional data fusion, characterized in that, The system for implementing the cloud security situation awareness method based on multi-dimensional data fusion as described in claim 1 includes: The feature fusion module is used to perform weighted fusion of the multi-dimensional situation feature vector set of communication nodes in the cloud environment based on the preset initial weights of each dimension, so as to obtain the encryption security situation feature vector of the cloud environment. The ciphertext evaluation module is used to perform ciphertext status evaluation operations on the homomorphic encryption status feature vector obtained by homomorphic encryption technology and the cryptographic evaluation benchmark parameters in the cloud environment to generate the ciphertext status evaluation result of the cloud environment. The contribution calculation module is used to decrypt the ciphertext situation assessment result and calculate the cryptographic contribution of the plaintext situation assessment result obtained after decryption in each dimension. The weight output module is used to adjust the initial weights of each dimension proportionally according to the correspondence between the cryptographic contribution and the initial weights, generate the fusion weights of the cloud environment, and output the overall security level of encrypted communication determined according to the plaintext situation assessment results, the cryptographic contribution, and the fusion weights as the situation awareness results of the cloud environment.

Images