Cross-domain behavior profile exchange method, apparatus, device, medium and program product

Abstract

The application relates to a cross-domain behavior portrait exchange method, device, equipment, medium and program product. The method is applied to a first node and a second node connected in mutual communication, and comprises the following steps: the first node acquires terminal access behavior data and encapsulates the terminal access behavior data into a first behavior portrait comprising a sensitivity label, receives a communication establishment request sent by the second node and extracts a sharing configuration parameter from the communication establishment request, matches the sharing configuration parameter with the sensitivity label, performs hierarchical desensitization processing on a data field according to a matching result to generate a second behavior portrait, and sends the second behavior portrait to the second node. The second node performs cross-domain cooperative defense based on the second behavior portrait and local business, and returns a cooperative response result to the first node, so that the first node triggers a specific defense action. The method can realize peer-to-peer cooperative protection between different network domain nodes, and significantly improves the joint defense efficiency of the whole distributed network in response to complex security threats.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus, computer device, computer-readable storage medium, and computer program product for cross-domain behavioral profile exchange. Background Technology

[0002] With the development of private communication networks and edge computing technologies, the Vertical Application Domain (VAD) has become an important computing domain for supporting industry business and security analysis. Each VAD node typically has the ability to acquire terminal access behavior data in dimensions such as user identity, terminal information, network slices, and resource access paths.

[0003] Existing systems suffer from the following objective technical deficiencies when handling cross-domain data interaction: First, different vertical application domains employ differentiated data structures and serialization formats, resulting in significant inconsistencies in the naming and semantics of data fields, making data parsing and interoperability between systems extremely difficult. Second, cross-domain shared data naturally contains highly sensitive information such as user identifiers and terminal device attributes. Direct cross-domain sharing and transmission without fine-grained control can easily lead to privacy leaks and compliance risks. Third, due to the aforementioned data format barriers and privacy constraints, the threat perception of security nodes is often limited to the local scope. There is a lack of a global dimension identification mechanism for cross-domain attacks such as lateral penetration, resulting in delayed or ineffective anomaly detection and making it difficult to form an effective cross-domain joint defense system. Summary of the Invention

[0004] Therefore, it is necessary to provide a method, apparatus, computer equipment, computer-readable storage medium, and computer program product for cross-domain behavior profile exchange that can safely and efficiently perform cross-domain security perception and linkage response, addressing the aforementioned technical issues.

[0005] In a first aspect, this application provides a cross-domain behavioral profile exchange method, applied to a first node, wherein the first node and the second node are located in different network domains and communicate with each other, the method comprising:

[0006] Acquire terminal access behavior data and encapsulate the terminal access behavior data into a first behavior profile, the first behavior profile including data fields with sensitivity tags;

[0007] Receive the communication establishment request sent by the second node, extract the shared configuration parameters from the metadata of the communication establishment request, and establish a bidirectional streaming communication channel with the second node;

[0008] The shared configuration parameters are matched with the sensitivity tags, and based on the matching results, hierarchical desensitization processing is performed on the corresponding data fields in the first behavior profile to generate a second behavior profile.

[0009] The second behavioral profile is sent to the second node through the bidirectional streaming communication channel, so that the second node can combine local data to perform cross-domain collaborative defense and receive feedback information returned by the second node based on the second behavioral profile.

[0010] In one embodiment, the sensitivity label includes a first sensitivity, a second sensitivity, and a third sensitivity, wherein the first sensitivity is greater than the second sensitivity, and the second sensitivity is greater than the third sensitivity;

[0011] The step of matching the shared configuration parameters with the sensitivity tags, and performing desensitization processing on the corresponding data fields in the first behavior profile based on the matching results, includes:

[0012] The shared configuration parameters are parsed into corresponding trust level indicators, and the trust level indicators are compared with the level of the sensitivity labels.

[0013] If the comparison result corresponds to the sensitivity label as the first sensitivity, privacy noise-adding processing is performed on the corresponding data field based on the trust level index as the control parameter.

[0014] If the comparison result corresponds to the second sensitivity label, data masking is performed on the corresponding data field;

[0015] If the comparison result corresponds to the sensitivity label as third sensitivity, the corresponding data field is retained.

[0016] In one embodiment, sending the second behavioral profile to the second node includes:

[0017] Based on the remote procedure call framework, the second behavioral profile is sent to the second node through the target interaction mode in the active push mode, on-demand query mode, or continuous subscription mode.

[0018] In one embodiment, the feedback information includes coordinated scheduling instructions;

[0019] After receiving the feedback information returned by the second node based on the second behavioral profile, the method further includes:

[0020] According to the risk flow control category indicated by the coordinated scheduling instruction, a corresponding defense action is triggered locally. The defense action includes: defense interception against network slice identifiers, establishing a one-way communication link for state synchronization, and maintaining the current interaction mode of the bidirectional streaming communication channel.

[0021] Secondly, this application also provides a cross-domain behavioral profile exchange method, applied to a second node, the second node being communicatively connected to the first node, the method comprising:

[0022] A communication establishment request is sent to the first node. The metadata of the communication establishment request includes shared configuration parameters, so that the first node can perform desensitization processing on the first behavior profile based on the matching result of the shared configuration parameters and the sensitivity label to generate a second behavior profile.

[0023] Receive the second behavioral profile sent by the first node through a bidirectional streaming communication channel;

[0024] The second behavioral profile is integrated with local business data, and cross-domain collaborative defense is executed.

[0025] Return feedback information based on the second behavioral profile to the first node.

[0026] In one embodiment, the step of fusing the second behavioral profile with local business data and performing cross-domain collaborative defense includes:

[0027] Identify the de-identification processing category corresponding to each data field in the second behavioral profile;

[0028] Depending on the different types of desensitization processing, a group statistical analysis strategy, a source association comparison strategy, or a direct data fusion strategy are adopted to perform joint security modeling of the corresponding data fields with the local business data.

[0029] In one embodiment, the step of fusing the second behavioral profile with local business data and performing cross-domain collaborative defense includes:

[0030] Extract network slice identifiers and resource access path data from the second behavioral profile;

[0031] The network slice identifier and the resource access path data are structurally aligned and feature-fused with the local network topology data of the second node to generate a spliced ​​feature matrix.

[0032] The spliced ​​feature matrix is ​​input into a preset path behavior evaluation model to obtain a topology path anomaly index.

[0033] Based on the abnormal indicators of the topology path, the corresponding defense response action is triggered.

[0034] In one embodiment, triggering the corresponding defense response action based on the topology path anomaly indicator includes:

[0035] The topology path anomaly index is compared with a preset risk threshold range, which includes high risk, medium risk and low risk.

[0036] When the topology path anomaly indicator is in the high-risk range, switch the current interaction mode to the active push mode, generate a collaborative scheduling instruction for broadcasting defense interception data for the network slice identifier, and distribute the blacklist to the outside.

[0037] When the topology path anomaly index is in the medium-risk range, switch the current interaction mode to continuous subscription mode, perform one-way state synchronization, and send a synchronization scheduling instruction to the first node.

[0038] When the abnormal index of the topology path is in the low-risk range, the current interaction mode is maintained and determined as normal access behavior.

[0039] Thirdly, this application also provides a cross-domain behavior profile exchange device, applied to a first node, wherein the first node and the second node are located in different network domains and communicate with each other, the device comprising:

[0040] A profile encapsulation module is used to acquire terminal access behavior data and encapsulate the terminal access behavior data into a first behavior profile, the first behavior profile including data fields with sensitivity tags.

[0041] The channel negotiation module is used to receive the communication establishment request sent by the second node, extract the shared configuration parameters from the metadata of the communication establishment request, and establish a bidirectional streaming communication channel with the second node.

[0042] The hierarchical desensitization module is used to match the shared configuration parameters with the sensitivity tags, and perform hierarchical desensitization processing on the corresponding data fields in the first behavior profile based on the matching results to generate a second behavior profile;

[0043] The cross-domain collaboration module is used to send the second behavioral profile to the second node through the bidirectional streaming communication channel, so that the second node can perform cross-domain collaborative defense in combination with local data, and receive feedback information returned by the second node based on the second behavioral profile.

[0044] Fourthly, this application also provides a cross-domain image exchange device, applied to a second node, the second node being communicatively connected to the first node, the device comprising:

[0045] The request initiation module is used to send a communication establishment request to the first node. The metadata of the communication establishment request includes shared configuration parameters, so that the first node can perform desensitization processing on the first behavior profile based on the matching result of the shared configuration parameters and the sensitivity label to generate a second behavior profile.

[0046] The image receiving module is used to receive the second behavioral image sent by the first node through a bidirectional streaming communication channel;

[0047] The collaborative defense module is used to integrate the second behavioral profile with local business data and perform cross-domain collaborative defense.

[0048] The status feedback module is used to return feedback information based on the second behavior profile to the first node.

[0049] Fifthly, an electronic device includes a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the steps of the above-described method.

[0050] Sixthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-described method.

[0051] In a seventh aspect, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the above-described method.

[0052] The aforementioned cross-domain behavioral profile exchange method, apparatus, computer equipment, computer-readable storage medium, and computer program product encapsulate behavioral profiles using a standardized structured serialization format, thereby unifying the communication language of systems in different network domains, significantly reducing the difficulty of parsing data across systems, and making cross-domain data interaction smoother.

[0053] Secondly, by automatically negotiating based on the other party's trust level when establishing a connection, sensitive data is subjected to hierarchical physical anonymization, ensuring that valuable data can still be shared without leaking user privacy.

[0054] Furthermore, the anonymized profiles are pushed to the cloud in real time via a two-way streaming channel. The cloud then integrates and calculates these profiles with global data. Once abnormal behavior is detected, a blacklist is immediately issued. This allows various independent network domains to instantly coordinate, forming a globally unified defense network with extremely fast response. Attached Figure Description

[0055] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0056] Figure 1 This is a diagram illustrating the application environment of a cross-domain behavior profile exchange method in one embodiment.

[0057] Figure 2 This is a flowchart illustrating a cross-domain behavior profile exchange method in one embodiment;

[0058] Figure 3 This is a flowchart illustrating the step of generating a second behavioral profile in one embodiment;

[0059] Figure 4 This is a flowchart illustrating the cross-domain behavior profile exchange method in another embodiment;

[0060] Figure 5 This is a schematic diagram of the signaling interaction between the first node and the second node in one embodiment;

[0061] Figure 6 This is a structural block diagram of a cross-domain behavior profile exchange device in one embodiment;

[0062] Figure 7 This is a structural block diagram of a cross-domain behavior profile exchange device in another embodiment;

[0063] Figure 8 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0064] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of this application.

[0065] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0066] In network environments with distributed computing and private network collaboration, different vertical application domains face some unresolved objective technical shortcomings when handling cross-domain data interaction: each network domain originally operates independently, and due to the lack of unified data standards and peer-to-peer interaction methods, data parsing becomes difficult. Furthermore, due to the lack of secure and trustworthy collaboration mechanisms, each node's defense against cross-domain attacks such as lateral penetration is often limited to its local area, making it difficult to form a global joint defense system.

[0067] To address the aforementioned shortcomings, this application proposes a peer-to-peer, dynamically negotiated profile exchange concept. Specifically, it first standardizes the encapsulation of behavioral profiles across nodes in different network domains. Based on this, during the connection establishment phase, two nodes exchange privacy-sharing configurations through metadata exchange, achieving intelligent privacy disclosure control. Subsequently, profile data is transmitted in real-time between peer nodes. Anomaly indicators are calculated through feature fusion of local data from both parties, and synchronous collaborative defense strategies are implemented, thereby upgrading the previous isolated defense approach of individual nodes to a real-time, interconnected joint defense system.

[0068] To make the above concepts and technical solutions clearer, the cross-domain behavioral profile exchange method provided in this application embodiment can be applied to, for example... Figure 1 The application environment shown is typically a distributed network security environment composed of multiple peer nodes distributed across different network domains. These different physical network nodes are interconnected via high-speed communication links, jointly undertaking the tasks of terminal behavior monitoring and collaborative risk defense. Specifically, this application environment mainly includes a first data processing device 101 and a second data processing device 103 that establishes a communication connection with the first data processing device 101.

[0069] The first data processing device 101 is typically deployed at a specific business boundary, such as a network access gateway or business server. It is responsible for collecting terminal access behavior data in the area in real time and encapsulating this complex data into a unified first behavior profile using a standardized structured serialization format. At the same time, it can perform hierarchical desensitization processing on sensitive data according to the trust level of the peer node to generate a second behavior profile.

[0070] The second data processing device 103 is generally a collaborating party with the same security processing capabilities as the first node, such as a security protection module or collaborative defense unit of another network domain. It is responsible for receiving the second behavioral profile sent by the first data processing device 101, aligning it with local business data in terms of structure and fusing its features, and performing cross-domain collaborative defense through a path behavior evaluation model.

[0071] In actual operation, the first data processing device 101 and the second data processing device 103 interact through a high-performance remote call communication framework that supports bidirectional streaming transmission. The first data processing device 101 can complete privacy negotiation with the second data processing device 103 during the initial connection establishment phase. Subsequently, the first data processing device 101 pushes the anonymized behavioral profile to the second data processing device 103 in real time. After deep feature fusion and risk assessment, the second data processing device 103 sends feedback information, including state synchronization or defense interception instructions, back to the first data processing device 101. Through this bidirectional linkage mechanism, the defense method of each node acting alone is upgraded to a real-time collaborative defense system.

[0072] In one exemplary embodiment, such as Figure 2 As shown, a cross-domain behavioral profile exchange method is provided, which can be applied to... Figure 1 Taking the first data processing device 101 as an example, the description includes the following steps 210 to 240. Wherein:

[0073] Step 210: Obtain terminal access behavior data and encapsulate the terminal access behavior data into a first behavior profile, which includes data fields with sensitivity labels.

[0074] Among them, terminal access behavior data can be a multi-dimensional information set that reflects the access trajectory and status of users or terminal devices in the network, such as user identity information, device physical address, network slice characteristics currently used, and specific accessed resource paths; sensitivity labels can be classification identifiers used to characterize the privacy importance of corresponding data fields.

[0075] For example, during its daily operation, the first node continuously collects various terminal activity trace data from terminal devices within its business scope. To address the issue of incompatibility between data languages ​​across systems, the first node encapsulates this scattered raw data using a standardized structured data serialization format, thereby generating a consistent first-behavior profile. During this encapsulation process, the first node also incorporates privacy recognition rules, automatically assigning corresponding sensitivity tags to each data field in the profile, providing foundational data support for subsequent differentiated privacy protection actions.

[0076] Step 220: Receive the communication establishment request sent by the second node, extract the shared configuration parameters from the metadata of the communication establishment request, and establish a bidirectional streaming communication channel with the second node.

[0077] Metadata can be the basic data used in the communication establishment request to describe the attributes of the request itself and the additional control protocol; shared configuration parameters can be parameters that the second node declares the plaintext level or trust level of the data it can accept.

[0078] For example, when a second node in another network domain needs to perform security collaborative analysis with the first node, it initiates a communication establishment request. Upon receiving the request, the first node does not need to wait for additional special negotiation instructions, but directly reads the shared configuration parameters from the metadata during the communication handshake phase. Subsequently, based on high-performance remote procedure calls and other network communication technologies, the first node establishes a bidirectional streaming communication channel with the second node that supports simultaneous and continuous data transmission and reception, greatly improving the real-time performance of subsequent cross-domain data transmission.

[0079] Step 230: Match the shared configuration parameters with the sensitivity tags, and perform hierarchical desensitization processing on the corresponding data fields in the first behavior profile based on the matching results to generate the second behavior profile.

[0080] Among them, graded desensitization processing can be the masking or perturbation of data by applying different strengths of privacy protection algorithms according to different privacy matching degrees.

[0081] For example, the first node extracts the shared configuration parameters it just acquired and automatically compares them one by one with the sensitivity tags inherent in each data field of the first behavior profile. If it finds that the sensitivity of certain fields is higher than the privacy acceptance permissions currently granted to the second node, the first node will invoke algorithms such as data noise enhancement or hash concealment to obfuscate these specific fields, while retaining the original state of low-sensitivity fields that match the permissions. Through this dynamic negotiation-based intelligent masking process, the system automatically generates a second behavior profile that retains business characteristics while complying with privacy compliance requirements.

[0082] Step 240: Send the second behavioral profile to the second node through a two-way streaming communication channel so that the second node can combine local data to perform cross-domain collaborative defense and receive feedback information returned by the second node based on the second behavioral profile.

[0083] The feedback information can be a linkage control instruction or status report generated by the second node after completing the cross-domain comprehensive risk assessment.

[0084] For example, the first node utilizes the established high-speed bidirectional streaming communication channel to push the anonymized profile of the second behavior to the second node in real time. Upon receiving the profile, the second node can overcome the limitations of the original single-point defense, jointly modeling and analyzing the profile transmitted from across domains with its local network topology and business data, thereby accurately identifying cross-domain attack behaviors with lateral movement intent. Finally, the first node receives feedback information calculated and sent by the second node, and can then automatically execute coordinated defense actions in its local network domain based on this feedback information, forming a complete security collaborative flow control system.

[0085] In the aforementioned cross-domain behavioral profile exchange method, by uniformly encapsulating terminal access behavior data into a first behavioral profile containing sensitivity tags, the data standards between different network domains are unified, solving the problem of difficult cross-domain data parsing and interoperability in the background technology. Furthermore, by extracting shared configuration parameters from the metadata established through communication and matching them with sensitivity tags to perform hierarchical desensitization processing, the system can dynamically adjust the granularity of privacy disclosure based on the trust status of the peer, achieving multi-domain data sharing while minimizing compliance risks of highly sensitive information leakage. Finally, by using a bidirectional streaming communication channel to push the profile to the second node and receive feedback information for cross-domain collaborative defense, the security silos between nodes are successfully broken down, constructing a joint defense closed loop with a global perspective and extremely fast response.

[0086] In some embodiments, when the first node encapsulates the first line into a profile in step 210, it also generates a globally unique association identifier for each profile. This association identifier is usually a combination of the timestamp of the profile generation, the original data source, and a random code.

[0087] Specifically, the first node encapsulates this association identifier as part of the metadata within the profile. When the second node receives the profile, it can continuously track the profile using this association identifier, whether for storage or subsequent risk analysis. If an anomaly is detected in a later stage, the first node can quickly trace back to the original source of the profile's collection using this identifier, ensuring that every piece of data is traceable and effectively improving data auditability.

[0088] In some embodiments, before establishing a bidirectional streaming communication channel with the second node in step 220, the first node needs to strictly verify the identity of the other party. The first node typically uses a bidirectional transport layer security protocol or performs the identity verification action based on a public key infrastructure system.

[0089] Specifically, the first node requests a valid digital certificate from the second node. Only after confirming the certificate's validity and verifying the identities of both parties will the first node officially open the communication port and establish a connection. This approach ensures that data is transmitted between trusted partners and prevents forged nodes from impersonating the second node to obtain sensitive behavioral profiles.

[0090] In an exemplary embodiment, step 230 involves matching shared configuration parameters with sensitivity tags, and performing desensitization processing on the corresponding data fields in the first-row profile based on the matching results, including steps 232 to 234, wherein:

[0091] Step 232: Parse the shared configuration parameters into the corresponding trust level indicators, and compare the trust level indicators with the level of sensitivity labels. The sensitivity labels include first sensitivity, second sensitivity and third sensitivity, and the first sensitivity is greater than the second sensitivity, and the second sensitivity is greater than the third sensitivity.

[0092] In this system, the first sensitivity level represents the highest security level, the second sensitivity level represents the medium security level, and the third sensitivity level represents the lowest security level. The trust level index is typically a numerical value used by the first node to measure the trustworthiness of the second node, derived by parsing the request metadata established through communication. Privacy-enhancing noise processing usually refers to adding small random perturbations to the original data, making it impossible to directly deduce the true value while ensuring the accuracy of statistical analysis. Data masking usually refers to replacing or masking parts of sensitive information with specific characters, thereby hiding the true information.

[0093] Step 234 involves applying differentiated processing methods to content with varying levels of sensitivity within the behavioral profile. This includes:

[0094] When the comparison result corresponds to the highest sensitivity level, privacy-preserving noise enhancement is performed on the corresponding data field based on the trust level index as a control parameter. Specifically, when the comparison result shows that a data field belongs to the highest sensitivity level, the first node extracts the current trust level index and inputs it as a control parameter into a preset noise enhancement algorithm. Based on this parameter, corresponding random noise is generated and superimposed on the original data. This protects data privacy while preserving the statistical properties required for subsequent analysis.

[0095] When the comparison result corresponds to the second level of sensitivity, data masking is performed on the corresponding data field. Specifically, when the comparison result corresponds to the second level of sensitivity, which is a medium level of protection, the first node will directly apply data masking, such as replacing the middle few digits of the user's mobile phone number with asterisks, or replacing the precise address with a regional overview.

[0096] If the comparison result corresponds to the third level of sensitivity, the corresponding data field is retained. Specifically, when the comparison result corresponds to the third level of sensitivity, which is the lowest level of protection, the first node considers that the data has little impact on privacy and security, so no additional processing is required, and the original value of the data field is directly retained and sent to the second node.

[0097] The hierarchical data anonymization method provided in the above embodiments effectively solves the problem of balancing data sharing and privacy protection in existing technologies by dynamically mapping the sensitivity of data to the trust level of the requester. This approach can intelligently select protection strategies such as noise enhancement, masking, or direct retention based on the needs of different scenarios and nodes. This avoids the loss of value due to excessive anonymization preventing data from generating value through fusion analysis at the second node, and also avoids the risk of leakage of highly sensitive data due to the transmission of plaintext information, greatly improving the compliance and flexibility of cross-domain data sharing.

[0098] like Figure 3 The diagram illustrates a second behavioral profile generation and processing flow provided in this embodiment. After obtaining the privacy sharing configuration from the second node, the first node performs conditional matching between the permission scope included in the configuration and the preset sensitivity tags of each data field in the behavioral profile. After completing the differentiated desensitization operations for different branches, the first node re-aggregates the processed data fields to generate a second behavioral profile that meets security and compliance requirements. This mode, which automatically triggers different processing logics based on the privacy sharing configuration, ensures that each data field enters the subsequent cross-domain transmission and analysis stages in the most appropriate form, thus guaranteeing both security and compliance while retaining the necessary business characteristics required for multi-domain joint defense.

[0099] In some embodiments, the first node also runs a local detection program to perform a preliminary risk assessment of the data before sending the behavioral profile.

[0100] Specifically, the first node analyzes terminal access behavior data to calculate a local risk score, which is then compared to a pre-set sending threshold. If the locally assessed risk score is low, the first node can send only a simplified version containing a profile summary to the second node; only when the locally assessed risk score exceeds the sending threshold will the first node send a second behavioral profile containing the complete context. This approach not only reduces network transmission pressure but also makes the transmitted data more targeted, improving the analysis efficiency of the second node.

[0101] In one exemplary embodiment, to more flexibly adapt to data transmission needs in different network scenarios, the first node can send behavioral profile data to the second node using various interaction methods. Based on the remote procedure call framework, the second behavioral profile is sent to the second node through a bidirectional streaming communication channel. The target interaction mode can be an active push mode, an on-demand query mode, or a continuous subscription mode.

[0102] For example, the remote procedure call framework can adopt Google Remote Procedure Call (gRPC), a technology framework that allows a program to run code on another computer and communicate efficiently. After establishing a communication connection with the second node, the first node will select an appropriate target interaction mode based on the specific business scenario and network conditions.

[0103] In the proactive push mode, the first node can immediately send the profile data to the second node after detecting specific risky behavior. If the current network environment is relatively idle and real-time risk monitoring is required, the first node can be configured to proactive push mode, and once it captures the profile data of abnormal behavior, it will be directly transmitted through a two-way streaming communication channel.

[0104] On-demand query mode allows the second node to query the first node when it needs to perform risk analysis, and the first node responds with profile data upon receiving the query. If the second node only needs data during periodic large-scale security assessments, the first node can switch to on-demand query mode, avoiding unnecessary data transmission at other times and only sending the profile when requested by the second node.

[0105] The continuous subscription model allows the second node to pre-register the event types it is interested in with the first node. The first node then sends the matching profile data to the second node at fixed time intervals or according to rules. If the network environment requires long-term stable data synchronization, the first node can adopt the continuous subscription model to push profiles to the second node at a predetermined pace. This flexible approach allows the first node to automatically adjust its sending strategy based on business needs, ensuring that data transmission is both timely and accurate.

[0106] The image sending method provided in the above embodiments effectively solves the problems of low efficiency in cross-domain data transmission and unidirectional communication limitations in the background technology by configuring multiple interaction modes. Different interaction modes can adapt to diverse business scenarios, avoiding bandwidth waste caused by unnecessary data transmission, and ensuring that data can be pushed across domains with extremely high efficiency when real-time risk response is required. Thus, while ensuring system operating efficiency, it significantly improves the flexibility of cross-domain data interaction.

[0107] In an exemplary embodiment, to achieve a faster and more automated security response, after sending the behavioral profile, the first node dynamically adjusts its defense status based on the evaluation results of the second node. Step 240, which receives feedback information from the second node based on the second behavioral profile, includes a collaborative scheduling instruction. The method further includes triggering a defense action locally according to the risk flow control category indicated by the collaborative scheduling instruction.

[0108] The risk flow control categories include high-risk, medium-risk, and normal access categories. The high-risk category corresponds to situations where the topology path anomaly indicator exceeds the emergency threshold; the medium-risk category corresponds to situations where the topology path anomaly indicator is between the normal and emergency thresholds; and the normal access category corresponds to situations where the topology path anomaly indicator is below the normal threshold. Defensive actions can be physical or logical interception and configuration adjustment operations taken by the first node to block risks, including defensive interception of network slice identifiers, establishing unidirectional communication links for state synchronization, and maintaining the current interaction mode of bidirectional streaming communication channels.

[0109] For example, after sending profile data to the second node, the first node will listen for the returned feedback information in real time. Once it receives the information, the first node will immediately parse the collaborative scheduling instructions and identify the risk flow control category of the current network behavior.

[0110] If the instruction indicates that the current risk level is high, the first node will immediately take defensive actions, such as blocking or intercepting network slices identified in the profile, thereby blocking malicious traffic at the edge.

[0111] If the instruction indicates that the current risk level is medium, the first node will periodically synchronize its local status with the second node by establishing a one-way communication link, so that the second node can continuously monitor it.

[0112] If the instruction indicates that the current access is a normal access category, the first node does not need to perform additional interception or synchronization operations. It maintains the current interaction mode of the existing bidirectional streaming communication channel to ensure that network operation is not affected.

[0113] The feedback control method provided in the above embodiments effectively solves the problems of isolated defense among security nodes and delayed response to cross-domain attacks in the background technology by triggering targeted defense actions locally according to the coordinated scheduling instructions of the second node. This approach enables nodes distributed in different network domains to coordinate in real time. Once a risk is detected, the first node can complete traffic interception or state adjustment for specific services locally the moment it receives the instruction. This upgrades the original passive defense system to a joint defense system with global response capabilities, significantly improving the network's response speed and accuracy to various complex threats.

[0114] In one exemplary embodiment, such as Figure 4 As shown, a cross-domain behavioral profile exchange method is provided, which can be applied to... Figure 1 Taking the second data processing device 103 as an example, the description includes the following steps 310 to 340. Wherein:

[0115] Step 310: Send a communication establishment request to the first node. The metadata of the communication establishment request includes shared configuration parameters, so that the first node can perform desensitization processing on the first behavior profile based on the matching result of the shared configuration parameters and the sensitivity label to generate the second behavior profile.

[0116] For example, when a second node discovers a potential anomaly within its own network domain and needs to obtain intelligence from other network domains for comparison, it will proactively initiate a collaboration request to the first node. To ensure privacy compliance, the second node includes shared configuration parameters in the request's metadata, allowing the first node to clearly understand which data is safe to transmit subsequently. This guides the first node to complete the filtering and de-identification of the profile, ensuring that cross-domain collaboration is conducted under conditions of mutual consent and equal security permissions.

[0117] Step 320: Receive the second behavioral profile sent by the first node through the bidirectional streaming communication channel.

[0118] For example, after issuing a collaboration request, the second node receives the second behavioral profile data from the first node through a bidirectional streaming communication channel agreed upon by both parties. Since the channel is connected in real time, the second node does not need to repeatedly initiate connection requests, which ensures that the data acquisition process is efficient and coherent, enabling the second node to promptly grasp the relevant behavioral characteristics within the first node's domain.

[0119] Step 330: Integrate the second behavioral profile with local business data and execute cross-domain collaborative defense.

[0120] For example, after obtaining the profile, the second node overlays and analyzes this cross-domain intelligence with its locally observed business flows. Based on paths or device characteristics of common interest to both nodes, it cross-compares the profile data with local business records. If the behavioral characteristics in the cross-domain profile match the abnormal paths observed locally, the second node can confirm that this is a coordinated attack event. This enables joint assessment of threat intelligence between the two nodes, upgrading the originally isolated local defense to cross-domain joint defense.

[0121] Step 340: Return feedback information based on the second behavioral profile to the first node.

[0122] For example, after completing the joint analysis, the second node will encapsulate the analysis conclusions and recommended follow-up actions as feedback information and send it to the first node through a two-way streaming communication channel. This feedback information may include the second node's current risk assessment results or recommendations for coordinated defense strategies to be implemented by the first node. For instance, the two parties may agree to take unified defense measures for a specific path.

[0123] In this embodiment, through this mechanism of mutual exchange and peer-to-peer communication, the first node and the second node jointly weave a cross-domain security awareness network, realizing joint risk prevention.

[0124] like Figure 5 The diagram shown illustrates a signaling interaction between a first node and a second node according to an embodiment of this application. This interaction process demonstrates the steps between the two nodes from establishing a connection to coordinating defense, including:

[0125] First, the second node sends a communication establishment request to the first node. The metadata of this request carries shared configuration parameters. Upon receiving the request, the first node parses the shared configuration parameters in the metadata and sets a security baseline for subsequent behavioral profile data transmission based on the privacy disclosure policy determined by the configuration.

[0126] Secondly, the first node establishes a bidirectional streaming communication channel with the second node. After extracting and confirming the shared configuration parameters, the first node uses remote procedure call (RPC) technology to establish a bidirectional channel with the second node that supports real-time and continuous data transmission. Thereafter, data transmission between the two nodes does not require repeated handshakes, significantly reducing system overhead.

[0127] In addition, the first node sends the anonymized second behavioral profile to the second node in real time via a bidirectional streaming communication channel. Prior to this, the first node had already completed the encapsulation and hierarchical anonymization of the original terminal access behavior data. After receiving this data, the second node performs feature fusion with local business data and analyzes it using a path behavior evaluation model.

[0128] Furthermore, the second node returns feedback information based on the second behavioral profile to the first node. This feedback information typically carries collaborative scheduling instructions. Upon receiving the feedback information, the first node triggers corresponding defensive actions locally according to the risk flow control category indicated by the instructions. For example, the first node can perform physical interception on a specific network slice identifier, establish a one-way state synchronization link, or maintain the current communication state, thereby completing the entire collaborative defense process.

[0129] pass Figure 5 The signaling interaction shown demonstrates that the first and second nodes can efficiently complete the entire process from data collection, privacy and security negotiation, real-time transmission to joint defense, ensuring that the entire system can flexibly adjust the interaction mode and respond to security interception based on the real-time threat level of the network environment.

[0130] In some embodiments, to ensure that the data source for collaborative analysis is authentic and reliable, the second node will perform an authentication action on the first node before receiving the profile in step 320.

[0131] Specifically, the second node utilizes a locally deployed trust management module to communicate with the public key infrastructure service. When the first node attempts to establish a connection, the second node requests a valid digital identity certificate from the first node. By verifying the certificate's signature information, issuing authority, and validity period, the second node confirms the first node's legitimate qualifications for collaborative communication. Only after successful verification will the second node officially initiate a bidirectional streaming communication channel and begin receiving profile data. This effectively prevents forged, unauthorized nodes from injecting false profile information into the second node.

[0132] In addition, in order to extract effective security clues from privacy-processed data, the second node can adopt different strategies for in-depth analysis and joint modeling based on how the data is processed.

[0133] In an exemplary embodiment, step 330 involves fusing the second behavioral profile with local business data and performing cross-domain collaborative defense, employing strategy one, including:

[0134] Step 3312: Identify the de-identification processing category corresponding to each data field in the second-row profile.

[0135] For example, after receiving the second-behavior profile, the second node examines the descriptive information carried in the data fields to determine how the data underwent processing before being sent. For instance, the system identifies which fields have been randomly perturbed, which have undergone hash mapping, and which are unprotected raw data. This identification process ensures that the second node clearly understands the credibility and true meaning behind each piece of data, providing a basis for determining which analysis strategy to use subsequently.

[0136] Step 3314: Based on different desensitization processing categories, adopt the corresponding group statistical analysis strategy, same-source association comparison strategy, or direct data fusion strategy to perform joint security modeling of the corresponding data fields with local business data.

[0137] For example, a group statistical analysis strategy could be used to identify anomalies by analyzing the changing trends of large-scale data, particularly noisy data. If a field is identified as having been noise-added, the second node will not attempt to restore its precise value. Instead, it will employ a group statistical analysis strategy to observe the fluctuation trends of this type of data. If the overall values ​​deviate from the normal range, a risk is identified.

[0138] The same-origin association comparison strategy can be applied to hash-mapped data, determining whether data originates from the same source or is from the same object by comparing features without restoring the original information. If a field is identified as having undergone hash mapping, the second node will employ the same-origin association comparison strategy, verifying the hash value to confirm whether the current visitor is the same person as the previously recorded attacker, thus achieving accurate source tracing.

[0139] The direct data fusion strategy can be used to directly substitute the original plaintext information into the security assessment model for reserved fields. If a reserved field is identified, the second node will adopt the direct data fusion strategy to directly incorporate this precise information into its own risk assessment model. Through the combination of multiple strategies, the second node can combine the anonymized data from the first node with local records to form a complete joint security analysis view.

[0140] The fusion and modeling method provided in the above embodiments effectively solves the problem in the background technology where data loses its analytical value due to privacy protection by adopting corresponding analysis strategies according to the de-identification processing category. This approach not only respects the privacy attributes of the data, but also, through intelligent strategy selection, enables the second node to still uncover threat characteristics through statistical and correlation comparison methods even when the data is masked or noise-added. This method allows for deep intelligence sharing between different network domains, constructing a joint security analysis model capable of responding to cross-domain attacks, and significantly improving the accuracy and scientific rigor of the entire collaborative defense system.

[0141] In an exemplary embodiment, step 330 involves fusing the second behavioral profile with local business data and performing cross-domain collaborative defense, employing strategy two, including:

[0142] Step 410: Extract network slice identifiers and resource access path data from the second row profile.

[0143] Among them, network slice identifiers are usually used to identify the specific code of the service group to which the terminal device belongs, and resource access path data can be the sequence of nodes that the terminal device passes through in the network when requesting the target server.

[0144] For example, after obtaining the profile data, the second node will prioritize extracting the network slice identifier and resource access path data from the complex fields. This information directly reflects the specific connection characteristics of the terminal at the network layer and is the core basis for determining whether network behavior is unauthorized or abnormal.

[0145] Step 420: The network slice identifier and resource access path data are structurally aligned and feature-fused with the local network topology data of the second node to generate a spliced ​​feature matrix.

[0146] Local network topology data typically represents the logical representation of the physical connections between network devices within the area where the second node is located. Structure alignment can be the process of converting externally received path data into a format that matches the local topology, according to a unified standard. The concatenated feature matrix is ​​usually a set of values ​​that comprehensively reflects the correspondence between the current access path and the local network environment.

[0147] For example, the second node will compare the extracted access path with the local network device connection tables to determine the specific trajectory of the path within the current topology. By fusing the path data with local physical connection relationships, the second node can transform the originally isolated path features into a concatenated feature matrix containing connection logic relationships. This matrix acts like a dynamic navigation map, clearly demonstrating the location and rationality of the current access behavior within the local network structure.

[0148] Step 430: Input the spliced ​​feature matrix into the preset path behavior evaluation model to obtain the topology path anomaly index.

[0149] Among them, the path behavior evaluation model is usually a combination of algorithms used to calculate the rationality of the path, and the topology path anomaly index can be used to measure the degree of deviation of the current path from the normal business logic.

[0150] For example, the second node feeds the concatenated feature matrix into a pre-trained path behavior evaluation model. This model calculates and extrapolates the current matrix based on historical normal path distribution characteristics, ultimately deriving a specific topology path anomaly index. A low value indicates that the current access path is logically sound within the local network; a high value indicates a serious logical deviation in the current access path, such as bypassing the core firewall or accessing an unauthorized isolated zone.

[0151] Step 440: Based on the abnormal topology path indicators, trigger the corresponding defense response action.

[0152] Among them, the defense response actions can be operations such as traffic interception, access permission changes, or interaction mode adjustments taken by the second node to block risks.

[0153] For example, the second node compares the calculated anomaly index of the topology path with a preset threshold. When the value exceeds the emergency threshold, indicating an extremely high risk, the second node immediately switches its current interaction mode and sends feedback information containing coordinated scheduling instructions to the first node, requesting physical interception of the specific slice identifier at the network egress. When the value is in the medium-risk range, the second node adjusts its interaction mode to continuous subscription to more precisely record subsequent changes to the path. When the value is in the low-risk range, the second node determines it as normal access and maintains its current operating state.

[0154] The path topology-based collaborative defense method provided in the above embodiments effectively solves the problem of difficulty in identifying complex path attacks in the background technology by fusing cross-domain profiling with features of the local network structure. This approach upgrades defense from simple numerical comparison to rigorous evaluation based on physical connection logic. It can not only identify which access paths are logically illogical, but also trigger automated interception responses in a targeted manner through calculated anomaly indicators, significantly improving the overall defense depth and reliability of the network against covert attacks such as lateral movement.

[0155] Furthermore, Strategy One focuses on security analysis at the data attribute level, that is, statistically analyzing and correlating business attributes and identity identifiers in the profile to determine the legitimacy of the request itself; while Strategy Two focuses on path verification at the network topology level, determining whether the access path conforms to a normal network structure. In actual security protection, these two strategies are usually used in parallel, and multi-dimensional superimposed analysis can greatly improve the accuracy of identifying complex attacks.

[0156] In some embodiments, when the second node performs step 330, it invokes a pre-built joint risk assessment model.

[0157] Specifically, the second node concatenates the user access sequence and terminal attributes from the received second behavior profile with locally stored normal business baseline data to construct a vector matrix containing multi-dimensional features. The second node then inputs this vector matrix into a combined autoencoder and single-class support vector machine model to calculate the current deviation value. If the deviation value exceeds a preset risk alarm threshold, the second node determines that the profile is abnormal and triggers subsequent collaborative defense procedures.

[0158] By comparing user access sequences and device fingerprints in the profile with historical normal business baselines in multiple dimensions, focusing on whether the current behavior deviates from the user's or device's consistent habits, it is possible to align the originally scattered cross-domain data with local data in the feature space, thereby discovering subtle logical anomalies and preventing forged or mutated behavioral patterns.

[0159] In some embodiments, after performing cross-domain collaborative defense, if the second node determines that a cross-domain penetration attack exists, the second node will generate a blacklist update request.

[0160] Specifically, the request includes the identifiers of endpoints or network slices identified as high-risk. The second node broadcasts this blacklist update request to all other nodes with which it has established a collaborative relationship via a bidirectional streaming communication channel, including the first node that initiated the collaboration and other subscribed partners. Upon receiving the blacklist, each receiving node automatically adds the corresponding blocking record to its local firewall or access control list, thereby achieving rapid joint prevention and control against the same threat across the entire network.

[0161] In an exemplary embodiment, 440 triggers a corresponding defense response action based on anomaly indicators of the topology path, including:

[0162] Step 442: Compare the topology path anomaly indicators with the preset risk threshold range, which includes high risk, medium risk and low risk.

[0163] For example, the second node compares the real-time calculated anomaly indicators of the topology path with internally preset numerical segments. If the indicator value exceeds the defined upper limit, it is classified as a high-risk segment; if the value is between two intermediate values, it is classified as a medium-risk segment; and if the indicator is below the defined lower limit, it is classified as a low-risk segment. This segmented comparison method allows the second node to quickly determine the danger level of the current network behavior based on the severity of the threat.

[0164] Step 444: When the topology path anomaly indicator is in the high-risk range, switch the current interaction mode to the active push mode, generate a collaborative scheduling instruction for broadcasting defense interception data for network slice identifiers, and distribute the blacklist to the outside.

[0165] For example, once the current access path is detected as being in a high-risk zone, it indicates that the network environment is facing a serious threat. The second node will immediately switch its communication mode to proactive push mode to ensure that information is sent out as quickly as possible. Simultaneously, the second node will quickly generate a collaborative scheduling instruction, explicitly indicating that the network slice identifier involved in the path is at risk, and requiring collaborating parties to jointly execute interception operations. Subsequently, the second node will distribute this blacklist data containing the interception logic, allowing other collaborating nodes to synchronously update their defense strategies and work together across the entire network to block these abnormal behaviors.

[0166] Step 446: When the topology path anomaly indicator is in the medium-risk range, switch the current interaction mode to continuous subscription mode, perform one-way state synchronization, and send a synchronization scheduling instruction to the first node.

[0167] For example, when an access path is found to be in a medium-risk range, while the connection may not be immediately interrupted, high vigilance is required. The second node will switch its interaction mode to continuous subscription mode, establishing a stable state channel with the first node. At this time, the second node will send synchronization scheduling instructions, requesting the first node to periodically return the current business flow status. Through this one-way state synchronization method, the second node can monitor all subsequent actions of the path in real time, thereby conducting in-depth observation and prevention of potential risks without affecting normal business operations.

[0168] Step 448: When the topology path anomaly indicator is in the low-risk range, maintain the current interaction mode and determine it as normal access behavior.

[0169] For example, when the comparison results show that the topology path anomaly index is in the low-risk range, it means that the current access behavior is completely in line with network logic and no abnormal signs have been found. At this time, the second node will not interfere with normal business traffic, but will maintain the interaction mode that has been established between the two parties, without making any changes to the current communication status, to ensure that normal access behavior can proceed smoothly, thereby ensuring the efficient use of network resources.

[0170] The tiered defense response method provided in the above embodiments effectively solves the problems of one-size-fits-all or delayed responses in the prior art by associating risk levels with interaction modes and collaborative actions. This approach achieves the effect of automatically adjusting defense intensity according to the threat level. Under high risk, it can quickly achieve network-wide coordinated blocking through broadcast blacklists; under medium risk, it can maintain observation through state synchronization; and under low risk, it ensures that business operations are not affected. This differentiated security response strategy not only significantly improves the network's ability to perceive and handle various attacks but also maximizes the balance between network security and business operation efficiency.

[0171] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0172] Based on the same inventive concept, this application also provides a cross-domain behavior profile exchange apparatus for implementing the cross-domain behavior profile exchange method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more cross-domain behavior profile exchange apparatus embodiments provided below can be found in the limitations of the cross-domain behavior profile exchange method described above, and will not be repeated here.

[0173] In one exemplary embodiment, such as Figure 6 As shown, a cross-domain behavioral profile exchange device is provided, applied to a first node. The first node and the second node are located in different network domains and communicate with each other. The device includes a profile encapsulation module 601, a channel negotiation module 603, a hierarchical desensitization module 605, and a cross-domain collaboration module 607, wherein:

[0174] The profile encapsulation module 601 is used to acquire terminal access behavior data and encapsulate the terminal access behavior data into a first behavior profile, which includes data fields with sensitivity labels.

[0175] The channel negotiation module 603 is used to receive the communication establishment request sent by the second node, extract the shared configuration parameters from the metadata of the communication establishment request, and establish a bidirectional streaming communication channel with the second node.

[0176] The hierarchical desensitization module 605 is used to match shared configuration parameters with sensitivity tags, and perform hierarchical desensitization processing on the corresponding data fields in the first-row profile based on the matching results to generate the second-row profile;

[0177] The cross-domain collaboration module 607 is used to send the second behavioral profile to the second node through a bidirectional streaming communication channel, so that the second node can combine local data to perform cross-domain collaborative defense and receive feedback information returned by the second node based on the second behavioral profile.

[0178] In an exemplary embodiment, the hierarchical desensitization module 605 matches shared configuration parameters with sensitivity tags, and performs desensitization processing on the corresponding data fields in the first row profile based on the matching results, including:

[0179] The shared configuration parameters are parsed into corresponding trust level indicators, and the trust level indicators are compared with the level of the sensitivity labels.

[0180] When the sensitivity label corresponding to the comparison result is the first sensitivity, privacy noise-adding processing is performed on the corresponding data field based on the trust level index as a control parameter.

[0181] If the sensitivity label corresponding to the comparison result is the second sensitivity, data masking is performed on the corresponding data field.

[0182] If the sensitivity label corresponding to the comparison result is third sensitivity, the corresponding data field is retained.

[0183] In an exemplary embodiment, the cross-domain collaboration module 607 sends a second behavioral profile to the second node, including:

[0184] Based on the remote procedure call framework, the second behavioral profile is sent to the second node through the target interaction mode in the active push mode, on-demand query mode, or continuous subscription mode.

[0185] In an exemplary embodiment, after the cross-domain collaboration module 607 receives feedback information returned by the second node based on the second behavioral profile, the device further includes a risk defense module. This module triggers defense actions locally according to the risk flow control category indicated by the collaborative scheduling instruction. The defense actions include: defense interception against network slice identifiers, establishing a one-way communication link for state synchronization, and maintaining the current interaction mode of the bidirectional streaming communication channel.

[0186] In one exemplary embodiment, such as Figure 7 As shown, a cross-domain behavioral profile exchange device is provided, applied to a second node, which is communicatively connected to the first node. The device includes: a request initiation module 701, a profile receiving module 703, a collaborative defense module 705, and a status feedback module 707, wherein:

[0187] The request initiation module 701 is used to send a communication establishment request to the first node. The metadata of the communication establishment request includes shared configuration parameters, so that the first node can perform desensitization processing on the first behavior profile based on the matching result of the shared configuration parameters and the sensitivity label to generate the second behavior profile.

[0188] The image receiving module 703 is used to receive the second-behavior image sent by the first node through a bidirectional streaming communication channel;

[0189] The collaborative defense module 705 is used to integrate the second behavioral profile with local business data and perform cross-domain collaborative defense.

[0190] The status feedback module 707 is used to return feedback information based on the second behavior profile to the first node.

[0191] In an exemplary embodiment, the collaborative defense module 705 integrates the second behavioral profile with local business data and performs cross-domain collaborative defense, including:

[0192] Identify the anonymization processing category corresponding to each data field in the second-line profile;

[0193] Depending on the different types of de-identification processing, corresponding group statistical analysis strategies, source association comparison strategies, or direct data fusion strategies are adopted to jointly model the corresponding data fields with local business data for security.

[0194] In an exemplary embodiment, the collaborative defense module 705 integrates the second behavioral profile with local business data and performs cross-domain collaborative defense, including:

[0195] Extract network slice identifiers and resource access path data from the second row of the profile;

[0196] The network slice identifier and resource access path data are structurally aligned and feature-fused with the local network topology data of the second node to generate a spliced ​​feature matrix.

[0197] The concatenated feature matrix is ​​input into a preset path behavior evaluation model to obtain the topological path anomaly index.

[0198] Based on the abnormal indicators of the topology path, the corresponding defense response action is triggered.

[0199] In an exemplary embodiment, the collaborative defense module 705 triggers a corresponding defense response action based on anomaly indicators of the topology path, including:

[0200] Compare the topology path anomaly indicators with the preset risk threshold range, which includes high risk, medium risk and low risk.

[0201] When the topology path anomaly indicator is in the high-risk range, switch the current interaction mode to the active push mode, generate a collaborative scheduling instruction for broadcasting defense interception data for network slice identifiers, and distribute the blacklist to the outside.

[0202] When the topology path anomaly indicator is in the medium-risk range, switch the current interaction mode to continuous subscription mode, perform one-way state synchronization, and send a synchronization scheduling instruction to the first node.

[0203] When the topology path anomaly indicator is in the low-risk range, maintain the current interaction mode and determine it as normal access behavior.

[0204] Each module in the aforementioned cross-domain behavioral profile exchange device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0205] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 8 As shown, the computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores cross-domain behavioral profile data. The I / O interfaces are used for information exchange between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements a cross-domain behavioral profile exchange method.

[0206] Those skilled in the art will understand that Figure 8 The structure shown is a block diagram of a partial structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.

[0207] In one embodiment, an electronic device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0208] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0209] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0210] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0211] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0212] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0213] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for cross-domain behavioral profile exchange, characterized in that, Applied to a first node, where the first node and the second node are located in different network domains and communicate with each other, the method includes: Acquire terminal access behavior data and encapsulate the terminal access behavior data into a first behavior profile, the first behavior profile including data fields with sensitivity tags; Receive the communication establishment request sent by the second node, extract the shared configuration parameters from the metadata of the communication establishment request, and establish a bidirectional streaming communication channel with the second node; The shared configuration parameters are matched with the sensitivity tags, and based on the matching results, hierarchical desensitization processing is performed on the corresponding data fields in the first behavior profile to generate a second behavior profile. The second behavioral profile is sent to the second node through the bidirectional streaming communication channel, so that the second node can combine local data to perform cross-domain collaborative defense and receive feedback information returned by the second node based on the second behavioral profile.

2. The method according to claim 1, characterized in that, The sensitivity label includes a first sensitivity, a second sensitivity, and a third sensitivity, wherein the first sensitivity is greater than the second sensitivity, and the second sensitivity is greater than the third sensitivity; The step of matching the shared configuration parameters with the sensitivity tags, and performing desensitization processing on the corresponding data fields in the first behavior profile based on the matching results, includes: The shared configuration parameters are parsed into corresponding trust level indicators, and the trust level indicators are compared with the level of the sensitivity labels. If the comparison result corresponds to the sensitivity label as the first sensitivity, privacy noise-adding processing is performed on the corresponding data field based on the trust level index as the control parameter. If the comparison result corresponds to the second sensitivity label, data masking is performed on the corresponding data field; If the comparison result corresponds to the sensitivity label as third sensitivity, the corresponding data field is retained.

3. The method according to claim 1, characterized in that, Sending the second behavioral profile to the second node includes: Based on the remote procedure call framework, the second behavioral profile is sent to the second node through the target interaction mode in the active push mode, on-demand query mode, or continuous subscription mode.

4. The method according to claim 1, characterized in that, The feedback information includes collaborative scheduling instructions; After receiving the feedback information returned by the second node based on the second behavioral profile, the method further includes: According to the risk flow control category indicated by the coordinated scheduling instruction, a corresponding defense action is triggered locally. The defense action includes: defense interception against network slice identifiers, establishing a one-way communication link for state synchronization, and maintaining the current interaction mode of the bidirectional streaming communication channel.

5. A method for cross-domain image exchange, characterized in that, Applied to a second node, which is communicatively connected to the first node, the method includes: A communication establishment request is sent to the first node. The metadata of the communication establishment request includes shared configuration parameters, so that the first node can perform desensitization processing on the first behavior profile based on the matching result of the shared configuration parameters and the sensitivity label to generate a second behavior profile. Receive the second behavioral profile sent by the first node through a bidirectional streaming communication channel; The second behavioral profile is integrated with local business data, and cross-domain collaborative defense is executed. Return feedback information based on the second behavioral profile to the first node.

6. The method according to claim 5, characterized in that, The step of fusing the second behavioral profile with local business data and executing cross-domain collaborative defense includes: Identify the de-identification processing category corresponding to each data field in the second behavioral profile; Depending on the different types of desensitization processing, a group statistical analysis strategy, a source association comparison strategy, or a direct data fusion strategy are adopted to perform joint security modeling of the corresponding data fields with the local business data.

7. The method according to claim 5, characterized in that, The step of fusing the second behavioral profile with local business data and executing cross-domain collaborative defense includes: Extract network slice identifiers and resource access path data from the second behavioral profile; The network slice identifier and the resource access path data are structurally aligned and feature-fused with the local network topology data of the second node to generate a spliced ​​feature matrix. The spliced ​​feature matrix is ​​input into a preset path behavior evaluation model to obtain a topology path anomaly index. Based on the abnormal indicators of the topology path, the corresponding defense response action is triggered.

8. The method according to claim 7, characterized in that, The triggering of corresponding defense response actions based on the anomaly indicators of the topology path includes: The topology path anomaly index is compared with a preset risk threshold range, which includes high risk, medium risk and low risk. When the topology path anomaly indicator is in the high-risk range, switch the current interaction mode to the active push mode, generate a collaborative scheduling instruction for broadcasting defense interception data for the network slice identifier, and distribute the blacklist to the outside. When the topology path anomaly index is in the medium-risk range, switch the current interaction mode to continuous subscription mode, perform one-way state synchronization, and send a synchronization scheduling instruction to the first node. When the abnormal index of the topology path is in the low-risk range, the current interaction mode is maintained and determined as normal access behavior.

9. A cross-domain behavioral profile exchange device, characterized in that, Applied to a first node, wherein the first node and the second node are located in different network domains and communicate with each other, the device includes: A profile encapsulation module is used to acquire terminal access behavior data and encapsulate the terminal access behavior data into a first behavior profile, the first behavior profile including data fields with sensitivity tags. The channel negotiation module is used to receive the communication establishment request sent by the second node, extract the shared configuration parameters from the metadata of the communication establishment request, and establish a bidirectional streaming communication channel with the second node. The hierarchical desensitization module is used to match the shared configuration parameters with the sensitivity tags, and perform hierarchical desensitization processing on the corresponding data fields in the first behavior profile based on the matching results to generate a second behavior profile; The cross-domain collaboration module is used to send the second behavioral profile to the second node through the bidirectional streaming communication channel, so that the second node can perform cross-domain collaborative defense in combination with local data, and receive feedback information returned by the second node based on the second behavioral profile.

10. A cross-domain image exchange device, characterized in that, The device is applied to a second node, which is communicatively connected to the first node, and includes: The request initiation module is used to send a communication establishment request to the first node. The metadata of the communication establishment request includes shared configuration parameters, so that the first node can perform desensitization processing on the first behavior profile based on the matching result of the shared configuration parameters and the sensitivity label to generate a second behavior profile. The image receiving module is used to receive the second behavioral image sent by the first node through a bidirectional streaming communication channel; The collaborative defense module is used to integrate the second behavioral profile with local business data and perform cross-domain collaborative defense. The status feedback module is used to return feedback information based on the second behavior profile to the first node.

11. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 4 or claims 5 to 8.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4 or claims 5 to 8.

13. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4 or claims 5 to 8.

Images