A cloud platform-based safe operation asset management and control method and system

Abstract

The application relates to a cloud platform-based safe operation asset management and control method and system. The method comprises the following steps: fusing evidence of resource state data and security behavior data in a cloud platform to obtain candidate asset object data; performing twin modeling on each target asset in the cloud platform according to the candidate asset object data to obtain asset digital twin data; performing time sequence graph atlas analysis on the correlation between different target assets according to the asset digital twin data to obtain asset time sequence relationship graph atlas data; performing trusted state analysis on each target asset according to the asset digital twin data and the asset time sequence relationship graph atlas data to obtain asset trusted state data and asset risk state data; and performing self-adaptive takeover on each target asset according to the asset trusted state data and the asset risk state data to obtain asset safe operation management and control data. The method can effectively improve the safe operation asset management and control efficiency.

Description

Technical Field

[0001] This application relates to the field of cloud computing technology, and in particular to a method and system for managing secure operational assets based on a cloud platform. Background Technology

[0002] In traditional technologies, security operations asset management utilizes methods such as network scanning, agent collection, log access, and manual ledgers to uniformly discover and register assets including servers, terminals, network devices, virtual machines, middleware, databases, application systems, and accounts. Secondly, standardized asset ledgers are established based on asset fundamental attributes, responsibility attribution, network location, business system, importance level, and lifecycle status, and data is kept up-to-date through regular inspections, change synchronization, and classification and grading mechanisms. Building upon this foundation, operational capabilities such as vulnerability scanning, baseline verification, patch management, weak password checks, exposure surface identification, and security alerts are linked to asset information to achieve "asset-centric" risk identification, disposal, remediation tracking, and statistical analysis, thereby supporting security monitoring, compliance checks, and operational performance evaluation. However, traditional technologies often rely on periodic scanning, manual maintenance, and multi-system integration for asset discovery and data updates, which can easily lead to asset omissions, information delays, incomplete correlations, and untimely responses to dynamic changes across environments, resulting in low efficiency in security operations asset management. Summary of the Invention

[0003] Therefore, it is necessary to provide a cloud-based method and system for managing and controlling security operation assets that can effectively improve the efficiency of security operation asset management and control, in response to the above-mentioned technical problems.

[0004] Firstly, this application provides a method for managing secure operational assets based on a cloud platform, including: Evidence fusion is performed on resource status data and security behavior data in the cloud platform to obtain candidate asset object data; Based on the candidate asset object data, a digital twin model is performed on each target asset in the cloud platform to obtain asset digital twin data; Based on the digital twin data of the assets, a time-series graph analysis is performed on the correlation between different target assets to obtain asset time-series relationship graph data; Based on the asset digital twin data and the asset time-series relationship graph data, a trust status analysis is performed on each of the target assets to obtain asset trust status data and asset risk status data. Based on the asset trust status data and the asset risk status data, adaptive takeover is performed on each of the target assets to obtain asset security operation and management data.

[0005] Secondly, this application also provides a cloud platform-based secure operation asset management system, including: a cloud platform and a terminal; The cloud platform is used to perform evidence fusion on resource status data and security behavior data in the cloud platform to obtain candidate asset object data; the resource status data and the security behavior data are collected through the terminal. The cloud platform is used to perform twin modeling on each target asset in the cloud platform based on the candidate asset object data, so as to obtain asset digital twin data; The cloud platform is used to perform time-series graph analysis on the relationship between different target assets based on the asset digital twin data, and obtain asset time-series relationship graph data; The cloud platform is used to perform a trust status analysis on each of the target assets based on the asset digital twin data and the asset time-series relationship graph data, so as to obtain asset trust status data and asset risk status data. The cloud platform is used to adaptively take over each of the target assets based on the asset trust status data and the asset risk status data, thereby obtaining asset security operation and management data.

[0006] The aforementioned cloud-based secure operation asset management method and system, by fusing resource status data and security behavior data from the cloud platform, continuously generates candidate asset objects during asset creation, modification, migration, reconstruction, and disappearance, avoiding asset omissions, duplicate registrations, and relationship distortions. Through twin modeling of candidate assets, it simultaneously preserves the static configuration, dynamic behavior, external dependencies, and lifecycle evolution information of target assets under a unified model, thereby improving the completeness and traceability of asset descriptions. Furthermore, by performing time-series graph analysis on the relationships between different target assets, it transforms traditional static topologies into dynamic relationship networks with propagation order, duration intervals, and evolutionary links. This system, by combining digital twin data of assets with asset time-series relationship graph data to perform trusted state analysis, can distinguish between the state drift of the target asset itself and the linkage offset caused by external links. It simultaneously outputs trusted state data and asset risk state data, thereby improving the accuracy of state judgment and the precision of risk location. Furthermore, based on the trusted state data and asset risk state data, adaptive takeover is implemented, dynamically adjusting the trusted operating boundary and high-risk action boundary without interrupting business or minimizing business interruption. Continuous operation is achieved through proxy takeover, original entity convergence, policy rewriting, and boundary control. Therefore, during operation, it features high automation in asset discovery, strong dynamic relationship characterization, high accuracy in risk assessment, timely control of anomaly propagation, strong business continuity assurance capabilities, and a complete overall security operation closed loop, effectively improving the efficiency of secure asset management. Attached Figure Description

[0007] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0008] Figure 1 This is an application environment diagram of a cloud platform-based security operation asset management method in one embodiment. Figure 2 This is a flowchart illustrating a cloud platform-based security operation asset management method in one embodiment. Figure 3 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0009] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0010] This application provides a cloud platform-based method for managing and controlling secure operational assets, which can be applied to, for example... Figure 1 In the application environment shown, terminal 102 communicates with cloud platform 104 via a network. A data storage system can store the data that cloud platform 104 needs to process. The data storage system can be integrated onto cloud platform 104, or it can be located in the cloud or on other network cloud platforms. Cloud platform 104 can be implemented using a standalone cloud platform or a cloud platform cluster composed of multiple cloud platforms.

[0011] In one exemplary embodiment, such as Figure 2 As shown, a method for managing and controlling secure operational assets based on a cloud platform is provided, which is then applied to... Figure 1 Taking the cloud platform as an example, the explanation includes the following steps 202 to 210. Wherein:

[0012] Step 202: Evidence fusion is performed on the resource status data and security behavior data in the cloud platform to obtain candidate asset object data.

[0013] Step 204: Based on the candidate asset object data, perform twin modeling on each target asset in the cloud platform to obtain asset digital twin data.

[0014] Step 206: Based on the asset digital twin data, perform time-series graph analysis on the relationships between different target assets to obtain asset time-series relationship graph data.

[0015] Step 208: Based on the asset digital twin data and the asset time-series relationship graph data, perform a credibility status analysis on each target asset to obtain asset credibility status data and asset risk status data.

[0016] Step 210: Based on the asset trust status data and asset risk status data, adaptive takeover is performed on each target asset to obtain asset security operation and management data.

[0017] This refers to the cloud infrastructure and cloud service operating environment used to support computing, storage, network, identity, application and data services, and to support elastic scheduling, unified management and interface calls.

[0018] Resource status data refers to structured or semi-structured data that reflects the current configuration, deployment location, specifications, permission boundaries, dependencies, and operating status of various resources within the cloud platform.

[0019] Among them, security behavior data refers to data that reflects dynamic processes such as access, invocation, communication, authentication, authorization changes, data flow, port activity, and policy hits within the cloud platform.

[0020] Evidence fusion refers to the process of aligning, merging, correcting, and correlating data from different sources, time granularities, and formats according to unified rules to form a unified set of evidence that can be used for subsequent analysis.

[0021] Among them, candidate asset object data refers to the data set formed after evidence fusion, which is used to represent suspected independent asset entities within the cloud platform and their basic attributes, behavioral characteristics and related clues.

[0022] Among them, target assets refer to specific cloud resource entities, logical service entities, or combinations thereof that are identified as requiring modeling, analysis, control, or takeover based on the candidate asset object data.

[0023] Twin modeling refers to the process of establishing a digital corresponding model based on the static attributes, dynamic behaviors, dependencies, and lifecycle changes of a target asset.

[0024] Among them, asset digital twin data refers to a multi-dimensional data set formed by twin modeling that can synchronously reflect the current state, historical changes, external dependencies and operational boundaries of the target asset.

[0025] Among them, the relationship refers to the connection between different target assets in terms of invocation, communication, control, authorization, dependence, data exchange or lifecycle linkage.

[0026] Among them, time series graph analysis refers to the process of organizing, arranging and graph-structured calculation of the relationships between different target assets by combining time sequence, duration interval, propagation direction and relationship evolution process.

[0027] Among them, asset time-series relationship graph data refers to a graph-based data set formed after time-series graph analysis, which includes target asset nodes, time-series relationship edges, propagation links, duration intervals, and directional states.

[0028] Among them, credible state analysis refers to the process of calculating and judging the convergence degree, stability degree and instability trend of the target asset by comprehensively considering its own operating state and its correlation changes in the time series relationship map.

[0029] Among them, asset trust status data refers to the data results obtained through trust status analysis, which reflect the target asset's current ability to maintain normal operation, sustain business operations, and recover.

[0030] Among them, asset risk status data refers to the data results obtained through credible status analysis, which reflect the current degree of instability, diffusion trend, degree of boundary spillover, and necessity of control of the target asset.

[0031] Adaptive takeover refers to the process of dynamically determining control boundaries based on asset trust status data and asset risk status data, and implementing differentiated management and control through methods such as substitute takeover, path transfer, authority contraction, and original entity consolidation.

[0032] Among them, asset security operation and control data refers to the data results generated after the completion of adaptive takeover, which are used to record the takeover status, boundary status, strategy execution status, substitute takeover status, original body convergence status and business continuity status of the target asset.

[0033] Specifically, resource status data and security behavior data are collected through the terminal interfaces corresponding to the cloud platform. Resource status data includes at least the resource identifiers, deployment locations, configuration parameters, dependency tags, and permission boundaries for cloud hosts, containers, virtual networks, load balancers, databases, object storage, account roles, and security policies. Security behavior data includes at least access requests, service calls, login events, communication sessions, authorization changes, port exposures, data flow, and policy hit records. The resource status data and security behavior data undergo processes including, but not limited to, field standardization, timestamp normalization, heterogeneous identifier mapping, duplicate record folding, missing field compensation, and source credibility assignment to eliminate differences in format, granularity, and naming between different collection sources. Then, using resource master identifier, behavior subject identifier, relation object identifier, and time proximity window as joint constraints, cross-source alignment is performed on static configuration fragments in resource status data and dynamic behavior fragments in security behavior data. A state-behavior cross-validation mechanism is used to verify whether the same object simultaneously possesses "existence evidence" and "activity evidence." Existence evidence proves that the object truly exists in the cloud platform and has clear boundaries, while activity evidence proves that the object participated in invocation, access, communication, or authorization activities within a preset time window. For objects that simultaneously satisfy both existence and activity evidence, clustering and merging are further performed based on configuration similarity, behavioral continuity, permission inheritance, and upstream / downstream association stability, converging multiple heterogeneous pieces of evidence belonging to the same logical entity into a single candidate object. For objects that only satisfy one side of the evidence, they are marked as objects to be verified and temporarily excluded from the formal candidate set. The final output is candidate asset object data, which includes at least the candidate asset identifier, asset category, source evidence set, evidence credibility, behavioral activity, relationship pointing information, and verification mark.

[0034] Based on the asset identifier, asset category, source evidence set, evidence credibility, behavioral activity, relationship information, and verification marker corresponding to each candidate asset object data, twin modeling is performed according to a four-layer structure: "static attribute layer - dynamic behavior layer - relationship dependency layer - lifecycle layer". The static attribute layer describes the basic identity and stable configuration of the target asset, including at least resource type, instance identifier, image version, deployment region, network location, business domain, permission boundary, and security policy baseline. The dynamic behavior layer describes the activity status of the target asset during operation, including at least access frequency, call direction, communication cycle, login mode, port usage characteristics, data read / write rhythm, and authorization change trajectory. The relationship dependency layer describes the call relationship, control relationship, data exchange relationship, permission inheritance relationship, and supply chain dependency relationship between the target asset and other assets. The lifecycle layer describes the evolution trajectory of the target asset from creation, expansion, migration, upgrade, reconstruction, scaling down to recycling. Then, based on the source evidence set in the candidate asset object data, evidence fragments of the same target asset across different time windows, different collection sources, and different running instances are consistently merged to construct a baseline twin image of the target asset. The baseline twin image is then dynamically corrected using behavioral activity and relationship pointing information to ensure it retains stable characteristics while reflecting the current operating state. However, for objects whose external identifiers change due to elastic scaling, container reconstruction, instance migration, or temporary credential switching, their configuration similarity, behavioral continuity, relationship continuity, and permission inheritance are compared to determine if they belong to a continuation instance of the same logical asset. If so, the corresponding evidence is merged into the same twin; otherwise, it is split into independent twins. Finally, the four-layer modeling results after merging and correction are encapsulated into asset digital twin data. This data includes at least the target asset's static attribute vector, dynamic behavior vector, relationship dependency matrix, lifecycle state chain, baseline twin image, real-time twin state, and corresponding evidence confidence.

[0035] Relational meta-events characterizing cross-asset relationships are extracted from the static attribute vectors, dynamic behavior vectors, relational dependency matrices, lifecycle state chains, baseline twin mirror images, and real-time twin states corresponding to the asset digital twin data. These relational meta-events include at least service call events, network communication events, permission granting events, data access events, configuration inheritance events, mirror reference events, policy action events, and lifecycle linkage events. Each relational meta-event is appended with a source asset identifier, target asset identifier, relation type identifier, trigger timestamp, duration, direction of action, intensity of action, and evidence confidence level. Then, temporal crease extraction is performed on relational meta-events triggered by different target assets within the same time window to identify the pre- and post-delay dependencies, concurrent coupling, delayed response, and progressive propagation characteristics between events. Based on the temporal creases, the associated fragments scattered in different twins are reassembled into arc segments, so that the call fragments, authorization fragments, access fragments, and evolution fragments originally belonging to the local states of different assets are reorganized into cross-asset relation arc segments. After forming cross-asset relationship arcs, multiple relationship arcs are further linked and arranged according to relationship type compatibility, temporal proximity, propagation continuity, and directional consistency to construct relationship chains composed of associations with two or more hops. By time-stamping the time tags in the relationship chains, a unified temporal expression of "occurrence sequence—duration interval—evolutionary trend" is established between assets on the same link. This allows the graph to not only reflect whether there is a relationship between assets, but also when the relationship was established, how it spreads, when it strengthens or weakens, and whether a propagation loop is formed. Finally, the completed linking and time-stamping relationship chains, relationship arcs, and their associated time parameters are mapped in a graph structure to generate asset temporal relationship graph data. This asset temporal relationship graph data includes at least a set of nodes, a set of temporal relationship edges, a set of cross-asset propagation chains, relationship direction parameters, relationship strength parameters, time evolution parameters, and the evidence confidence level corresponding to each relationship edge. This enables dynamic, continuous, and traceable modeling of the relationships between different target assets.

[0036] After loading the digital twin data of the assets and the asset time-series relationship graph data into a unified analysis space, state analysis units are established one by one according to the target assets. Within each state analysis unit, the static configuration set, real-time operation set, relationship link set, and life cycle evolution set are simultaneously aligned in terms of time, so that configuration changes, behavior changes, relationship changes, and evolution changes within the same analysis period are on the same comparison coordinate. Using the baseline twin mirror image corresponding to the target asset as a reference plane, the real-time twin state within the current analysis period is mirrored and differentiated on the attribute axis, behavior axis, and relationship axis, respectively. Combined with the adjacency links, propagation order, coupling strength, and duration of the target asset in the asset time-series relationship graph, propagation compensation is applied to the difference results, so that the linkage offset caused by abnormal transmission from upstream assets is separated from the state drift of the target asset itself during the calculation process. After differential calculation and compensation, perturbation projection is applied to the differential results of each axis, mapping the configuration-side offset, operation-side offset, and relationship-side offset to a unified perturbation coordinate system. Then, based on the link convergence, closed-loop coupling, permission boundary changes, and data access stability between the target asset and adjacent assets, a trusted risk dual-domain mapping is performed to form two sets of parallel intermediate results for the trusted domain and the risk domain. The trusted domain retains the state portion that remains convergent with the baseline twin mirror image, while the risk domain aggregates the state portions that exhibit continuous deviations, cross-chain propagation, or boundary instability. Convergence calculations are performed on continuous stable quantities in the trusted domain to output asset trusted state data. Aggregation calculations are performed on cumulative offsets, propagation gains, and boundary instability quantities in the risk domain to output asset risk state data. The trusted state data and risk state data are then associated one-to-one with the target asset and written back to the analysis result set. The asset trusted state data includes at least the trusted level, trusted retention, state stability, and recovery feasibility; the asset risk state data includes at least the risk level, propagation probability, boundary instability, and takeover priority.

[0037] For each target asset's trusted status data and risk status data, within the same control period, the continuous stable intervals in the trusted status data and the continuous offset intervals in the risk status data are jointly constrained according to time overlap, link coupling, permission contraction range, service continuity requirements, and data access sensitivity level. This forms the currently retainable trusted operating boundary and the high-risk action boundary that must be controlled for the target asset. Then, an adaptive takeover process is initiated around the takeover boundary. On the control plane side, security groups, access control policies, service mesh routing, credential validity domains, and session forwarding rules are synchronously rewritten. On the operating plane side, a substitute bearer instance or substitute proxy entry is established for the target asset, so that external service traffic, internal call chain traffic, and sensitive data access requests are diverted to the original path or substitute path according to the takeover boundary. Requests within the trusted operating boundary remain on the original path, while requests within the high-risk action boundary are migrated to the substitute path and subject to restricted execution, read-only execution, delayed forwarding, protocol convergence, or honeypot takeover. After the substitute path is established, operations are performed on the original assets, including shrinking the network exposure scope, closing high-risk ports, freezing high-risk permissions, reducing the scope of token availability, cutting off abnormal upstream links, and restricting the ability to write sensitive data. Non-essential tasks are switched to observation mode, ensuring the original retains only the minimum necessary operational capabilities. Throughout the takeover process, the link closure status, business response continuity, policy hit results, and boundary stability are continuously compared before and after the migration. When the substitute path reaches the preset carrying capacity and the risk increment after the original's convergence no longer propagates, the current takeover status, boundary adjustment status, policy execution status, substitute acceptance status, original convergence status, business continuity status, and recovery verification entry parameters are uniformly written into the asset security operation and management data.

[0038] In the aforementioned cloud platform-based security operation asset management method, by fusing resource status data and security behavior data from the cloud platform, candidate asset objects can be continuously generated during asset creation, modification, migration, reconstruction, and disappearance, avoiding asset omissions, duplicate registrations, and relationship distortions. By performing twin modeling on candidate assets, the static configuration, dynamic behavior, external dependencies, and lifecycle evolution information of target assets can be simultaneously preserved under a unified model, thereby improving the completeness and traceability of asset descriptions. Furthermore, by performing time-series graph analysis on the relationships between different target assets, the traditional static topology can be transformed into a dynamic relationship network with propagation order, duration intervals, and evolutionary links. This allows for a more accurate reflection of the abnormal propagation path and the scope of coupled impact. By combining asset digital twin data with asset time-series relationship graph data to perform trusted state analysis, it can distinguish between the target asset's own state drift and the linkage offset caused by external links. Simultaneously, it outputs asset trusted state data and asset risk state data, thereby improving the accuracy of state judgment and the precision of risk positioning. Furthermore, adaptive takeover is implemented based on the asset trusted state data and asset risk state data, enabling dynamic adjustment of trusted operating boundaries and high-risk action boundaries without interrupting business or minimizing business interruption. Continuous operation is achieved through proxy takeover, original entity convergence, policy rewriting, and boundary control. Therefore, during operation, it features a high degree of automated asset discovery, strong dynamic relationship characterization, high accuracy of risk assessment, timely abnormal propagation control, strong business continuity assurance capabilities, and a complete overall security operation closed loop, effectively improving the efficiency of secure asset management.

[0039] In an exemplary embodiment, based on asset digital twin data and asset time-series relationship graph data, a trust status analysis is performed on each target asset to obtain asset trust status data and asset risk status data, including steps 302 to 306. Wherein:

[0040] Step 302: Fold the temporal correlation edges in the asset temporal relationship graph data in reverse order to obtain the risk convergence trajectory data corresponding to each target asset.

[0041] Step 304: Based on the risk convergence trajectory data and the asset digital twin data, perform mirror difference analysis on each target asset to obtain credible disturbance data.

[0042] Step 306: Based on the credible perturbation data, perform credible risk dual-domain mapping on each target asset to obtain asset credible status data and asset risk status data.

[0043] Among them, temporal correlation edges refer to the relationship edges in the asset temporal relationship graph used to connect different target assets and carry information on the order of occurrence, duration, propagation direction and intensity of effect.

[0044] Among them, reverse folding refers to the process of compressing and merging multiple continuous or converging temporal association edges by taking the target asset as the backtracking endpoint and proceeding backward along the time and propagation of the association relationship.

[0045] Among them, risk convergence trajectory data refers to the data results formed after reverse folding, which are used to record the process of risk gradually flowing into the target asset along a multi-level correlation link.

[0046] Among them, mirror difference analysis refers to the process of comparing the current operating state of the target asset with its reference mirror state in multiple dimensions and calculating the offset difference under the constraint of risk convergence trajectory.

[0047] Among them, credible perturbation data refers to the data results generated after mirror difference analysis, which are used to reflect the current offset magnitude, persistence, coupling degree and recovery trend of the target asset.

[0048] Among them, the trusted risk dual-domain mapping refers to the process of simultaneously allocating the current changes of the target asset to the trusted domain and the risk domain based on trusted disturbance data, and forming two-sided state results respectively.

[0049] Specifically, all related edges in the asset time-series relationship graph are grouped into corresponding analysis sets according to the target asset. The start and end times, propagation direction, relationship type, duration, intensity, and link level of each related edge are uniformly sorted. Then, using the current moment of the target asset as the backtracking reference point, the upstream related edges connected to it are traversed layer by layer in reverse time, ensuring that the related edges closest to the target asset enter the operation sequence first, followed by those farther away. Inter-segment splicing is performed on related edges that are temporally connected and have continuous propagation directions; parallel compression is performed on related edges with similar intensity and compatible relationship types; and convergence is performed on multiple related edges that simultaneously converge to the target asset or the same intermediate node within the same time window. Propagation delay, path attenuation, coupling gain, and closed-loop return flow are simultaneously accumulated during each splicing, compression, or merging operation, thereby converging the propagation process, originally scattered across multiple links, nodes, and time slices, into several continuous reverse propagation segments. Then, each backward propagation segment is folded according to the order of "near-end priority, strong-edge priority, and closed-loop post-processing." This ensures that propagation segments directly adjacent to the target asset and with a stronger effect retain higher weights. Propagation segments that cross multiple levels but have shorter durations undergo attenuation compensation during folding. Propagation segments that form closed-loop backflows have their backflow rounds and backflow intervals recorded separately to avoid redundant amplification of the overall trajectory length by the closed-loop links. After all folding operations are completed, the time start point, time end point, cumulative intensity, cumulative delay, sequence of nodes passed through, number of closed loops, and attenuation results of each backward propagation segment are chained together according to the target asset to form the risk convergence trajectory data corresponding to that target asset.

[0050] For each target asset, within the same analysis period, the baseline twin image, real-time twin status, and corresponding risk convergence trajectory in the asset's digital twin data are uniformly time-aligned, ensuring that configuration changes, behavior changes, relationship changes, and the arrival time of risk propagation fall within the same comparison window. Then, using the baseline twin image as a reference plane, the magnitude of configuration item changes, the amount of permission boundary changes, the deployment location offset, and the version switching interval are compared item by item on the attribute axis. On the behavior axis, the fluctuation of access frequency, the offset of call rhythm, the changes in port activity, the changes in session duration, and the changes in data read / write cycle are continuously compared. On the relationship axis, the changes in the number of upstream and downstream connections, the changes in the length of the dependency chain, the increase or decrease of closed-loop links, and the changes in propagation coupling strength are compared. After completing the three-axis differencing, the risk convergence trajectory data is sequentially loaded into each axis differencing process according to the propagation arrival order, propagation dwell interval, cumulative propagation delay, and path attenuation results. Propagation compensation is performed on the differencing values ​​at each moment, so that the offset caused by upstream anomalies propagating along the link is reduced and distributed according to the propagation level and delay coefficient, while the offset caused by the target asset's own operational changes is enhanced and preserved according to the duration and density of local changes. The compensated attribute differencing, behavioral differencing, and relational differencing are mapped to a unified perturbation coordinate system, and coupled and merged according to the degree of overlap, synchronization, and accumulation of each differencing item within a continuous time window. This allows multi-axis fluctuations caused by the same source to form continuous perturbation segments after merging, while independent instantaneous fluctuations remain separate. Finally, the merged continuous perturbation segments are comprehensively calculated according to the perturbation amplitude, duration, propagation participation, closed-loop impact, and recovery slope to generate reliable perturbation data.

[0051] A dual-domain mapping computation space is established for the trusted disturbance data corresponding to each target asset. Within the same computation cycle, each continuous disturbance segment is arranged sequentially according to time order. Then, for each continuous disturbance segment, the disturbance amplitude, duration, slope of change, link coupling range, propagation gain, closed-loop participation, and fallback speed are calculated simultaneously. Continuous disturbance segments with smaller disturbance amplitude, shorter duration, slower slope of change, localized coupling range, and faster fallback speed are given priority to be sent to the trusted domain computation channel. Continuous disturbance segments with continuously increasing disturbance amplitude, duration spanning multiple analysis windows, steep increase in slope of change, coupling range spanning multiple levels of links, continuous accumulation of propagation gain, or increased closed-loop participation are given priority to be sent to the risk domain computation channel. Then, within the trusted domain calculation channel, continuous disturbance segments entering the channel are merged according to temporal proximity, recovery consistency, and local coupling overlap. After merging, the stability maintenance amount, recovery convergence amount, and remaining usable amount are calculated for each merged segment to form a trusted mapping result. Within the risk domain calculation channel, continuous disturbance segments entering the channel are aggregated according to propagation continuity, boundary spillover degree, and cross-link superposition degree. After aggregation, the risk accumulation amount, diffusion gain amount, and instability persistence amount are calculated for each aggregated segment to form a risk mapping result. After completing the parallel calculation of the two channels, the trusted mapping results are weighted and accumulated according to the stability maintenance amount, recovery convergence amount, and remaining usable amount, and the risk mapping results are weighted and accumulated according to the risk accumulation amount, diffusion gain amount, and instability persistence amount. During the weighting process, the overlapping parts that simultaneously enter the trusted domain and risk domain within the same time window are pruned to ensure that the same disturbance component is not repeatedly included in the two types of state results, thus obtaining asset trusted state data and asset risk state data.

[0052] In this embodiment, by first performing reverse folding on the temporal associated edges, then combining the digital twin of the asset to conduct mirror difference analysis, and finally completing the trusted risk dual-domain mapping, the risk propagation process, which was originally scattered on multiple associated links, can be compressed into a continuous convergence trajectory oriented towards the target asset. This ensures that multi-hop propagation, closed-loop backflow, and link coupling are not fragmented in subsequent state calculations. At the same time, by placing the current operating state of the target asset and the baseline twin mirror image under the same comparison coordinates during the mirror difference stage and superimposing propagation compensation, errors caused by relying solely on local anomalies for judgment can be reduced. Furthermore, after dual-domain mapping, the state calculation results no longer remain at a single risk score, but simultaneously provide parallel state results for the trusted side and the risk side, thereby facilitating the distinction between the parts that can still maintain operation and the parts that need to be prioritized for control.

[0053] In an exemplary embodiment, based on risk convergence trajectory data and asset digital twin data, mirror difference analysis is performed on each target asset to obtain credible perturbation data, including steps 402 to 406. Wherein:

[0054] Step 402: Perform echo deconvolution on the time-series propagation segments in the risk convergence trajectory data to obtain the disturbance response profile data.

[0055] Step 404: Perform twin stripping and reconstruction on the steady-state attribute data, variable dynamic attribute data, and relational attribute data in the asset digital twin data to obtain reference mirror data.

[0056] Step 406: Based on the disturbance response contour data and the reference mirror data, perform disturbance projection difference processing on each target asset to obtain reliable disturbance data.

[0057] Among them, the time-series propagation segment refers to a continuous propagation segment in which the risk propagates along the associated link within a specific time interval and has a clear start and end time, propagation direction, duration and magnitude of effect.

[0058] Echo deconvolution refers to the process of splitting and restoring the comprehensive propagation response formed by the superposition of multiple propagation segments on the time axis in order to separate the independent propagation effects.

[0059] Among them, disturbance response profile data refers to the data results formed after echo deconvolution, which are used to record the continuous change pattern, amplitude distribution and duration interval of the disturbances suffered by the target asset over time.

[0060] Among them, steady-state attribute data refers to configuration, permission, deployment location and long-term operating parameter data that remain relatively stable and fluctuate within a preset range over multiple consecutive analysis periods.

[0061] Among them, dynamic attribute data refers to state data that fluctuates dynamically during operation as access, invocation, session, task scheduling, or data read and write changes.

[0062] Among them, relational attribute data refers to data that reflects the call connections, dependency links, authorization relationships, data interaction relationships, and closed-loop coupling relationships between the target asset and other assets.

[0063] Among them, twin stripping and reconstruction refers to the process of separating the stable part from the fluctuating part in the digital twin of an asset, and realigning and reorganizing the stable part under a unified coordinate system.

[0064] Among them, reference mirror data refers to the stable state data formed after twin stripping and reconstruction, which is used as the benchmark surface for subsequent differential calculations of the target asset.

[0065] Among them, the perturbation projection difference processing refers to the process of aligning and projecting the perturbation response profile onto the attribute surface, behavior surface, and relation surface corresponding to the reference mirror and calculating the multidimensional offset difference.

[0066] Specifically, for the risk convergence trajectory data corresponding to each target asset, all temporal propagation segments within the risk convergence trajectory data are arranged into a continuous propagation sequence according to propagation arrival time, propagation dwell time, propagation level, and cumulative effect intensity. A convolutional response window is established with the target asset's current time as the response endpoint. Within the convolutional response window, temporally overlapping propagation segments are first segmented into windows, ensuring that each segmented window retains only propagation components with the same propagation direction and continuous effect. Then, delay bias and amplitude attenuation are calculated for propagation components that continue across windows to eliminate wake delay caused by multi-hop propagation. The segmented propagation components undergo echo deconvolution to decompose the combined propagation impact of multiple upstream nodes superimposed on the target asset via different links and at different times into several independent response components. Furthermore, repeated backflows caused by closed-loop links are deducted based on the number of backflow rounds; long-path attenuation introduced by higher-level links is compensated based on link length and dwell time; and amplitude overlap caused by concurrent links within the same time interval is separated and allocated according to the intensity ratio, ensuring that each independent response component corresponds to a defined start time, end time, propagation duration, and amplitude. After decomposing the independent response components, adjacent response components are contour-stitched according to temporal continuity and directional consistency. Response components with interruption intervals less than a preset threshold and continuous amplitude change slopes are merged into the same disturbance segment, while response components with interruption intervals exceeding the preset threshold or reversed direction remain separate. The cumulative amplitude, peak position, duration, fallback slope, and propagation hysteresis within each stitched disturbance segment are calculated and connected in chronological order to form disturbance response contour data.

[0067] Within the same modeling cycle, the steady-state attribute data within the asset digital twin is first fixed and aligned according to configuration baseline, deployment location, resource specifications, permission boundaries, and long-term fixed strategies to eliminate format and dimensional differences between different collection times. For variable dynamic attribute data, time smoothing and period compression are performed based on access frequency, call cycle, session duration, port activity period, read / write rhythm, and task scheduling interval, absorbing high-frequency jitter into local fluctuation bands instead of directly entering the baseline calculation surface. For relational attribute data, relational ordering is performed based on upstream and downstream connection duration, dependency chain stability interval, authorization continuation cycle, route switching frequency, and closed-loop link maintenance time, separating short-term temporary connections from long-term stable connections in subsequent calculations. These three types of attributes are then fed into the same reconstruction framework. Configuration items, operating intervals, and relational links that remain stable across multiple consecutive analysis windows are retained as the main chain. Instantaneous mutations, occasional peaks, temporary permission drifts, and short-term relation flips occurring only within short windows are bypassed and isolated, recording their occurrence time, duration, and offset magnitude during isolation without incorporating them into the reference master surface. After the stripping is completed, the steady-state attributes, normal operating ranges, and long-term relationship links retained in the main chain are reconstructed and aligned. This ensures that the attribute axis, behavior axis, and relationship axis coincide at the same reference time, the same computational granularity, and the same spatial coordinates. A consistency correction is then used to eliminate misalignments between the three axes caused by different sampling intervals, different change rhythms, and different update times. Finally, a joint convergence calculation is performed on the reconstructed multi-axis results. The portion that maintains stable convergence within the continuous analysis window is solidified as the reference state surface, while the portion that still exhibits significant fluctuations after correction is retained on the dynamic side, forming a reference mirror data.

[0068] The disturbance response profile data and reference mirror data are loaded into the same projection computation space and divided into continuous time windows according to a unified analysis period. Within each time window, attribute projection surfaces, behavior projection surfaces, and relationship projection surfaces are established to ensure that the disturbance response is aligned with the reference mirror in time, dimensions, and coordinates before entering differential computation. On the attribute projection surface, item-by-item projection comparisons are performed on configuration item changes, permission boundary changes, deployment location offsets, and version switching intervals. On the behavior projection surface, continuous projection comparisons are performed on access frequency offsets, call rhythm offsets, session duration offsets, port active interval offsets, and data read / write cycle offsets. On the relationship projection surface, correlation projection comparisons are performed on link number changes, link duration changes, coupling strength changes, closed-loop participation changes, and cross-node propagation delay changes. Offsets appearing simultaneously on the three projection surfaces within the same time window are aligned to ensure that multi-axis offsets caused by the same propagating disturbance are consistent in direction and phase. Further, offsets with short duration, low amplitude, and inability to continue across windows from the offset results obtained from each projection plane are retained as instantaneous differences. Offsets with long duration, continuously increasing amplitude, and synchronous occurrence across multiple projection planes are merged into continuous difference segments. Compensation correction is performed on continuous difference segments with phase misalignment between adjacent time windows to prevent timing misalignment caused by propagation hysteresis from being miscalculated as independent disturbances. The corrected continuous difference segments are then grouped according to amplitude, duration, synchronization degree, propagation participation, and recovery slope. Continuous difference segments with consistent directions and similar recovery trends converge into the same disturbance cluster, while continuous difference segments with opposite directions or significantly different recovery trends remain separate. Finally, the cumulative offset, peak position, duration, propagation coupling, and fallback rate of each disturbance cluster are jointly calculated to generate reliable disturbance data.

[0069] In this embodiment, by first performing echo deconvolution on the time-series propagation segment, then performing twin stripping reconstruction on the digital twin of the asset, and finally combining the disturbance response profile with the reference image to perform disturbance projection differential processing, the mixed effects formed by multi-hop propagation superposition, closed-loop backflow superposition, and local short-term fluctuation superposition can be decomposed into continuous and alignable disturbance profiles. Before the differential calculation, a reference base plane with unified correction across the attribute axis, behavior axis, and relation axis is obtained, thereby reducing differential distortion caused by propagation delay, phase misalignment, and instantaneous jitter, making the reliable disturbance data more concentrated in reflecting the continuous offset and coupling offset, and less likely to be amplified by isolated instantaneous changes or repeated propagation components.

[0070] In an exemplary embodiment, based on the disturbance response contour data and the reference mirror data, disturbance projection differential processing is performed on each target asset to obtain reliable disturbance data, including steps 502 to 508. Wherein:

[0071] Step 502: Project and consolidate the steady-state mirror layer in the reference mirror data to obtain mirror anchor domain data.

[0072] Step 504: Perform angular domain expansion on the temporal perturbation lobes in the perturbation response profile data to obtain perturbation projection flow data.

[0073] Step 506: Based on the mirrored anchor domain data and the perturbation projection flow data, perform off-axis compensation on each target asset to obtain differential coupling data.

[0074] Step 508: Based on the differential coupling data, perform credible perturbation extraction on each target asset to obtain credible perturbation data.

[0075] Among them, steady-state mirror layer: refers to the layered mirror unit formed by dividing the target asset into continuous stable state intervals according to time, space and axial coordinates within a unified analysis period.

[0076] Among them, projection consolidation refers to the process of compressing and fixing the state intervals of multiple steady-state mirror layers that maintain convergence in the same direction and low amplitude fluctuations within a continuous window onto a unified reference point.

[0077] Among them, mirrored anchorage data refers to the data results formed after projection consolidation, which are used to provide a fixed reference position and continuous boundary range for subsequent disturbance projection.

[0078] Among them, the time-series perturbation lobe refers to a local perturbation segment in the perturbation response profile that is continuously distributed along the time axis, has fluctuations, a peak position, and a duration.

[0079] Among them, angular domain expansion refers to the process of mapping the temporal perturbation lobes into a unified angular coordinate space according to the rising phase, peak phase and falling phase, and forming a continuous expansion pattern.

[0080] Among them, perturbation projection flow data refers to the data results formed after angular domain expansion, which are used to represent the continuous flow path, magnitude gradient and direction changes of the perturbation in the projection space.

[0081] Off-axis compensation refers to the process of synchronously correcting the positional, temporal, and scale offsets of the disturbed projected flow on the attribute, behavior, and relation axes around the mirror anchor domain.

[0082] Differential coupling data refers to the data results formed after off-axis compensation and multi-axis merging, which includes the cumulative offset of each continuous offset segment, coupling strength, synchronization degree and duration interval.

[0083] Among them, reliable perturbation extraction refers to the process of filtering, compressing and summarizing the continuous offset portion in the differential coupling result that is convergent, recoverable and has not formed a continuous diffusion.

[0084] Specifically, within a unified analysis period, the continuous stable intervals of the reference mirror data on the attribute axis, behavior axis, and relation axis are divided into multiple steady-state mirror slices according to the same time granularity, spatial scale, and axial order. Within each slice, coordinate normalization and boundary compression are performed on the configuration baseline, permission boundaries, deployment location, normal access frequency, normal call rhythm, session duration, long-term dependency links, and closed-loop maintenance intervals, ensuring that state variables in the same slice have a consistent landing range during subsequent projection. Continuity calibration is performed on overlapping intervals between adjacent steady-state mirror slices. State segments that maintain the same direction of change within multiple consecutive analysis windows, have amplitude fluctuations below a preset threshold, and time intervals not exceeding a preset window width are merged into the same consolidation zone. Simultaneously, cross-axis interlocking is implemented on state segments that synchronously maintain stability within the same time window on the attribute axis, behavior axis, and relation axis, ensuring they occupy corresponding positions on the three axes to avoid inter-axis misalignment during subsequent perturbation projection. After completing the interlayer merging and cross-axis interlocking, the boundary jumps caused by sampling cycle switching, short-term micro-jitter, or relation refresh delays at the edge positions of each consolidated region are buffered to ensure continuous connection of the same consolidated region between consecutive windows. Finally, all consolidated regions after smoothing correction are uniformly encapsulated according to time and axial order to form mirrored anchorage data.

[0085] Within a unified analysis period, the continuous disturbance process of the disturbance response profile data is divided into multiple adjacent bands with the same time granularity. For each band, the start time, peak arrival time, fall-off termination time, amplitude change slope, duration, propagation lag, and interval length between the preceding and following bands are calculated. Then, using the peak arrival time as the angular domain center reference, the start time to peak arrival time is mapped to the angular domain rise interval, the peak maintenance phase to the angular domain dwell interval, and the fall-off termination phase to the angular domain decay interval, so that the same disturbance band forms a continuously unfolding arc distribution in the angular domain space. For adjacent disturbance bands with small temporal misalignment but similar peak amplitudes, consistent change directions, and propagation lag within the allowable range, angular compensation is performed according to their peak time difference and duration, so that they connect end to end in the angular domain space to form a continuous streamline. Bands with large peak misalignment, opposite fall directions, or duration differences exceeding a preset threshold are kept separate to avoid erroneous superposition of disturbances from different sources in subsequent calculations. After phase correction, based on the amplitude gradient and directional continuity of each band in the angular domain, adjacent unfolded arc segments with smooth amplitude changes and consistent attenuation trends in the angular domain are connected and solidified. This transforms discrete bands into a continuously propagable perturbation projection stream. Peak positions caused by high-frequency short-time fluctuations during the connection process are smoothed and suppressed, and local discontinuities caused by propagation hysteresis are compensated for, ensuring that the perturbation projection stream remains continuous, monotonous, and directional in the angular domain space. Finally, the results after angular domain unfolding, phase correction, fluidization connection, and smoothing compensation are uniformly packaged according to time and angular domain order to obtain the perturbation projection stream data.

[0086] The mirrored anchor domain data and the perturbation projection stream data are loaded into the same compensation coordinate system, and three parallel compensation channels—attribute axis, behavior axis, and relationship axis—are established under a unified analysis period. The attribute axis channel carries anchor domain intervals corresponding to configuration baselines, permission boundaries, and deployment locations; the behavior axis channel carries anchor domain intervals corresponding to access frequency, call rhythm, session duration, and data read / write cycle; and the relationship axis channel carries anchor domain intervals corresponding to upstream / downstream connections, dependency chain persistence intervals, and closed-loop maintenance intervals. The perturbation projection stream data enters the corresponding anchor domain intervals in the three compensation channels in a predetermined time sequence. The lateral offset between the entry position and the anchor domain center position, the longitudinal offset between the entry time and the effective anchor domain window, and the scale offset between the persistence width and the anchor domain coverage width are calculated synchronously. Then, based on the fixed range of the anchor domain boundaries in each channel, intra-axis compensation is performed on the aforementioned offsets, ensuring that the lateral offset falls back to near the corresponding anchor domain center, the longitudinal offset falls within the effective anchor domain time window, and the scale offset matches the anchor domain coverage width. Then, for disturbance components that appear simultaneously in more than two compensation channels within the same time window, cross-axis linkage compensation is performed according to their entry order, peak position difference, duration difference, and consistency of change direction. This ensures that the multi-axis offsets caused by the same disturbance event remain consistent in amplitude, phase, and duration, preventing repeated accumulation or erroneous compensation of the same disturbance on different axes. The results of each axis after compensation are coupled and merged according to time proximity, direction consistency, and duration overlap. Compensation results that are continuous and have the same trend are merged into the same differential coupling segment, while compensation results with time intervals exceeding a preset threshold, opposite change directions, or excessively different durations are kept separate. Finally, the cumulative offset, coupling strength, synchronization degree, duration interval, and compensation residual are calculated for all differential coupling segments, and written into the differential coupling data according to the target asset.

[0087] Within a unified analysis period, all differentially coupled segments of the differentially coupled data are arranged into a continuous computation sequence in chronological order. For each differentially coupled segment, the cumulative offset, duration, coupling density, synchronization degree, compensation residual, peak hold time, and fallback slope are calculated simultaneously. Then, a reliable disjunction main chain is established with parameters as constraints. Differentially coupled segments with cumulative offsets within a preset upper limit, durations not exceeding a preset instability window, locally convergent coupling density, stable synchronization degree, and gradually decreasing compensation residuals are preferentially included in the reliable disjunction main chain. Differentially coupled segments with continuously increasing cumulative offsets, durations spanning multiple analysis windows, continuously expanding coupling density, unstable synchronization degree, or continuously increasing compensation residuals are not included in the reliable disjunction main chain. Within the trusted extraction main chain, adjacent differential coupling segments with time intervals less than a preset threshold, consistent direction of change, and similar retracement slopes are merged into a single trusted continuous segment, provided that small, consecutive offsets are maintained and temporal continuity is preserved. Local peaks caused by high-frequency micro-jitter are reduced, and recurring round-trip fluctuations with similar amplitudes are compressed to prevent short-cycle fluctuations from being repeatedly accumulated during trusted extraction. After intra-chain segment merging and reduction / compression, convergence weighting is performed on each trusted continuous segment. Trusted continuous segments with lower cumulative offsets, shorter durations, faster retracement slopes, and smaller compensation residuals receive higher retention weights, while those near instability boundaries, with slower recovery speeds, or still strongly coupled locally receive lower retention weights. This ensures that the trusted extraction results concentrate on retaining recoverable, convergent offsets that have not shown a diffusion trend. Finally, all weighted trusted continuous segments are aggregated according to the target asset to form trusted perturbation data.

[0088] In this embodiment, by first consolidating the continuous stable interval in the reference image into a mirror anchor region, then expanding the time-series disturbance lobes into a continuous disturbance projection flow, and completing off-axis compensation and reliable disturbance extraction under the constraints of the mirror anchor region, the disturbance calculation no longer depends on single-point offset or single-axis difference, but is completed under the common constraints of fixed reference landing point, continuous flow pattern and multi-axis synchronous correction. This reduces the accumulation of errors caused by inter-axis misalignment, phase drift, local spikes and short-term fluctuations, resulting in more reliable disturbance data with higher continuity, stability and comparability.

[0089] In an exemplary embodiment, based on the trusted perturbation data, a trusted risk dual-domain mapping is performed on each target asset to obtain asset trusted status data and asset risk status data, including steps 602 to 606. Wherein:

[0090] Step 602: Perform reverse phase separation on the perturbation components in the credible perturbation data to obtain the inter-domain coupling boundary data corresponding to each target asset.

[0091] Step 604: Based on the inter-domain coupling boundary data, perform dual-domain split mapping on each target asset to obtain trusted mapping data and risk mapping data.

[0092] Step 606: Based on the trusted mapping data and risk mapping data, perform state convergence analysis on each target asset to obtain asset trusted state data and asset risk state data.

[0093] Among them, the disturbance component refers to the continuous disturbance part of the reliable disturbance data that can be independently involved in state calculation after being divided according to time, amplitude, duration, coupling degree and change direction.

[0094] Among them, reverse phase separation refers to the process of separating the retraction and expansion parts of the same disturbance process along the boundary direction by pushing back from the end stage of the disturbance to the beginning stage of the disturbance.

[0095] Among them, inter-domain coupling boundary data refers to the data results formed after reverse phase separation, which are used to delineate the boundary position between the trust side and the risk side and their continuous change trajectory.

[0096] Among them, dual-domain split mapping refers to the process of allocating continuous disturbances of the same target asset to the trusted domain and the risk domain respectively around the inter-domain coupling boundary and forming a dual-sided mapping link.

[0097] Among them, trusted mapping data refers to the continuous mapping results formed after dual-domain splitting, which are used to reflect the target asset's ability to regress to the inside of the boundary, maintain stability, and maintain availability.

[0098] Risk mapping data refers to the continuous mapping results formed after dual-domain splitting, which reflect the expansion of target assets to the outside of the boundary, continuous instability, and the formation of diffusion trends.

[0099] Among them, state convergence analysis refers to the process of performing accumulation, pruning, segmentation and weighting calculations on the trusted mapping data and the risk mapping data respectively to obtain the final trusted state and risk state of the asset.

[0100] Specifically, within a unified analysis period, all continuous disturbance segments of the credible disturbance data are arranged into a reverse operation sequence according to time order. For each continuous disturbance segment, the cumulative offset, duration, slope of change, coupling density, synchronization degree, recovery slope, cross-link expansion width, and time interval and amplitude difference between adjacent disturbance segments are calculated simultaneously. Taking the end time of the continuous disturbance segment as the starting point of the reverse phase split, the process is pushed back segment by segment along the time axis. For intervals that have shown a downward trend, a shrinking coupling range, a decrease in synchronization degree, and a recovery slope that continues to converge towards the steady state, an inward merging is performed, causing these disturbances to shrink back to the credible side. However, for intervals where the cumulative offset continues to increase, the slope of change continues to rise, the cross-link expansion width increases, and the coupling density does not decrease, the disturbances are retained on the risk expansion side. However, adjacent consecutive perturbation segments that overlap in time are clipped according to their ending order, ensuring that the last segment to end within the same time window occupies the boundary position first. Consecutive perturbation segments with the same direction but different recovery speeds are split into phases based on the difference in recovery slope, allowing the faster-recovering segments to be incorporated into the trusted side first. Consecutive perturbation segments with similar amplitudes but opposite expansion trends are isolated by direction based on the rate of change of expansion width, preventing local fallback perturbations from mixing with continuous outward expansion perturbations at the same boundary position. After completing segment-by-segment backtracking, boundary clipping, phase splitting, and direction isolation, the boundary positions formed within each time window are then spliced ​​and corrected according to temporal proximity, coupling continuity, and amplitude transition smoothness, ensuring a continuous transition between boundary positions in consecutive windows without abrupt jumps. Finally, the corrected boundary positions are connected according to the target asset to form continuous boundary trajectories, and the corresponding start and end times, boundary widths, cumulative offsets inside and outside the boundary, and boundary change slopes are recorded, forming inter-domain coupled boundary data.

[0101] The inter-domain coupling boundary data is loaded into a unified mapping coordinate system, and the boundary position in each analysis window is used as the segmentation center. A trusted domain channel is established inside the boundary, and a risk domain channel is established outside the boundary. At the same time, continuous disturbance segments within the same analysis window are sorted according to their distance from the boundary position, consistency with the boundary change direction, and dwell time near the boundary. Continuous disturbance segments that are close to the boundary and have shown a shrinking trend are given priority to enter the trusted domain channel, while continuous disturbance segments that are farther away from the boundary, have a continuous outward expansion trend, and have a longer dwell time are given priority to enter the risk domain channel. Within the trusted domain channel, inward splicing is performed on continuous perturbation segments that are temporally adjacent, directional, and progressively closer to the boundary. After splicing, their stability maintenance, boundary regression, and remaining usable quantities are continuously calculated, forming several trusted mapping chains that continuously converge towards the inner boundary within the trusted domain channel. Within the risk domain channel, outward aggregation is performed on continuous perturbation segments that are temporally continuous, have superimposed amplitudes, and progressively wider than the boundary. After aggregation, their risk accumulation, diffusion gain, and instability duration are continuously calculated, forming several risk mapping chains that continuously expand outward from the boundary within the risk domain channel. After completing the chain operations for each of the two channels, edge correction is performed on continuous perturbation segments that are adjacent to both sides of the inter-domain coupling boundary and change simultaneously within the same time window. Inward compensation is performed on parts of the trusted domain channel that are too close to the boundary, and outward correction is performed on parts of the risk domain channel that excessively intrude into the boundary. Continuous perturbation segments with staggered changes near the boundary are reassigned to their respective channels according to the direction and duration of change to prevent the same continuous perturbation segment from being repeatedly accumulated in both channels. Finally, the results after inward splicing, outward aggregation, and edge correction are packaged separately according to the target assets. The calculation results of the trusted domain channel form trusted mapping data, and the calculation results of the risk domain channel form risk mapping data.

[0102] Within the same state analysis cycle, trusted mapping data and risk mapping data are loaded into a dual-channel convergence space, and the two types of mapping chains are arranged synchronously with a uniform time granularity, enabling one-to-one comparison between trusted-side changes and risk-side changes within the same time window. In the trusted-side channel, the stability holding amount, boundary regression amount, remaining available amount, continuous holding duration, and regression slope of each trusted mapping chain are accumulated window-by-window. For adjacent windows where the change direction is consistent, the amplitude difference is less than a preset threshold, and the regression trend is continuous, inter-chain merging is performed, forming a continuous convergence surface along the time axis for the trusted-side results. In the risk-side channel, the risk accumulation amount, diffusion gain amount, instability duration, boundary spillover amount, and expansion slope of each risk mapping chain are accumulated window-by-window. For adjacent windows where the expansion direction is consistent, the gain continuously increases, and the instability duration spans multiple windows, inter-chain merging is performed, forming a continuous expansion surface along the time axis for the risk-side results. After completing the segmentation calculations on both sides, overlapping and pruning are performed on the trusted and risky continuous segments that are simultaneously close to the boundary within the same time window. The portion of the trusted side already covered by spillover from the risky side is deducted, and the portion of the risky side that has shrunk back to the trusted boundary is reverted. For continuous segments exhibiting repeated back-and-forth movements near the boundary, single-stage assignment is performed based on duration and magnitude of change to avoid repeated accumulation of the same continuous segment in the results on both sides. Convergence calculation is performed on the pruned trusted continuous surface, allowing the stable holding quantity, boundary regression quantity, and remaining available quantity to form the asset trusted state value according to preset weights. Instability aggregation calculation is performed on the pruned risky continuous surface, allowing the risk accumulation quantity, diffusion gain quantity, instability duration quantity, and boundary spillover quantity to form the asset risk state value according to preset weights. During the calculation process, instantaneous peaks with drastic changes but insufficient duration are suppressed, while persistent changes that extend across the window are enhanced. Finally, the calculation results from the trusted and risky sides are written into the state result sets of the corresponding target assets, obtaining asset trusted state data and asset risk state data.

[0103] In this embodiment, by first performing reverse phase separation on the continuous changes in the credible disturbance, then carrying out dual-domain splitting around the formed inter-domain coupling boundary, and finally performing state convergence analysis on the credible side and the risk side respectively, the same target asset can simultaneously obtain the separation results of the inward regression part and the outward diffusion part within the same analysis period, thereby avoiding the simple compression of all disturbances into a single state quantity. In this way, the tug-of-war changes, local recovery changes and continuous spillover changes near the boundary can be processed separately during the calculation process, which reduces the mutual overlap between the credible state and the risk state, and enables the control action to respond more finely to different change trends inside and outside the boundary.

[0104] In an exemplary embodiment, based on inter-domain coupling boundary data, dual-domain split mapping is performed on each target asset to obtain trusted mapping data and risk mapping data, including steps 702 to 710. Wherein:

[0105] Step 702: Perform tension analysis on the boundary transition components in the inter-domain coupling boundary data to obtain the inter-domain tension data corresponding to each target asset.

[0106] Step 704: Based on the inter-domain tension data, perform heterogeneous flow splitting on each target asset to obtain credible candidate flow data and risk candidate flow data.

[0107] Step 706: Based on the trusted candidate stream data and the risk candidate stream data, mirror and attach each target asset to obtain dual-domain attachment data.

[0108] Step 708: Based on the dual-domain attachment data, perform cross-domain suppression on each target asset to obtain trusted mapping intermediate data and risk mapping intermediate data.

[0109] Step 710: Based on the trusted mapping intermediate data and the risk mapping intermediate data, perform domain value positioning on each target asset to obtain trusted mapping data and risk mapping data.

[0110] Among them, the boundary transition component refers to the local boundary change segment formed when the inter-domain coupling boundary undergoes position changes, width changes, and switching between internal and external effects within a continuous analysis window.

[0111] Among them, tension analysis refers to the process of decomposing the intensity and direction of the boundary change process based on the opposing differences between the contraction action inside the boundary and the expansion action outside the boundary.

[0112] Among them, interdomain tension data refers to the data results formed after tension analysis, which are used to record the antagonistic state of action on both sides of the boundary, the direction of tension, the intensity of tension, and the duration of tension.

[0113] Among them, the opposite flow diversion refers to the process of directing the continuous change process to the inner and outer channels of the boundary, respectively, based on the direction and intensity of the inter-domain tension.

[0114] Among them, reliable candidate flow data refers to the data results formed after the flow is diverted in opposite directions, which are used to reflect the continuously changing flow bundles that retract towards the inside of the boundary and tend to stabilize.

[0115] Among them, risk candidate flow data refers to the data results of continuously changing flow bundles formed after the opposite flow split, which are used to reflect the expansion to the outside of the boundary and the tendency to become unstable.

[0116] Among them, mirror attachment refers to the process of attaching trusted candidate streams and risky candidate streams along the inner and outer sides of the reference mirror boundary and completing the corresponding path processing.

[0117] Among them, dual-domain attachment data refers to the dual-boundary attachment result data formed after mirror attachment, which simultaneously contains the attachment trajectory of the trusted side and the attachment trajectory of the risk side.

[0118] Among them, cross-domain suppression refers to the process of applying opposite gain and opposite suppression to trusted side and risk side connection chains near the same boundary.

[0119] Among them, trusted mapping intermediate data refers to trusted side intermediate result data formed after cross-domain suppression and is used to continue calculating trusted mapping results.

[0120] Among them, risk mapping intermediate data refers to the risk-side intermediate result data formed after cross-domain suppression and is used to continue calculating the risk mapping results.

[0121] Threshold setting refers to the process of solidifying and fixing the intermediate results from the trust side and the risk side within a continuous time window to form the final threshold result.

[0122] Specifically, within a unified analysis period, the continuous boundary trajectories of inter-domain coupled boundary data are divided into multiple continuous transition intervals according to the same time granularity. For each transition interval, the boundary center position, boundary width, cumulative inner shrinkage, cumulative outer expansion, boundary displacement velocity, boundary width change rate, difference in the amount of action on both sides of the boundary, and time connection length between adjacent transition intervals are calculated. Using the boundary center position as the tension balance baseline, the shrinkage effect on the inner side of the boundary and the expansion effect on the outer side of the boundary within each transition interval are balanced in opposite directions. This ensures that the two sides act under a unified coordinate system within the same time window, forming a tension relationship of mutual pull. The boundary displacement velocity and boundary width change rate are written into the calculation process as tension direction correction terms and tension intensity correction terms, respectively. This gives higher outward tension weights to intervals that move outward rapidly and expand synchronously, and higher inward tension weights to intervals that contract rapidly and narrow synchronously. Next, the tension continuity between adjacent transition intervals is segmented and corrected. Adjacent intervals with consistent direction of change, continuous temporal connection, and intensity difference below a preset threshold are merged to form a single tension continuity segment. Adjacent intervals with reversed direction, sudden intensity jumps, or boundary width transitions are kept separate, and the tension abrupt change point and its corresponding boundary turning point are recorded at the separation location to prevent local abrupt changes from spreading to the preceding and following intervals. For each tension continuity segment after merging or separation, the cumulative tension value, peak tension location, tension duration, direction maintenance duration, and boundary sensitivity coefficient are calculated. The boundary sensitivity coefficient is determined by the boundary width change amplitude, boundary displacement velocity, and the difference in the amount of force applied to both sides, and is used to measure the severity of the boundary's response to disturbance changes. Finally, all tension continuity segments are connected sequentially according to the target asset, and their start and end times, tension direction, tension intensity, duration, peak location, and boundary sensitivity coefficient are uniformly recorded to form inter-domain tension data.

[0123] Within a unified diversion cycle, all continuous tension segments of inter-domain tension data are arranged into a continuous calculation sequence according to time order. Within each analysis window, both inward and outward diversion channels are simultaneously established. The inward diversion channel corresponds to the contraction direction inside the boundary, while the outward diversion channel corresponds to the expansion direction outside the boundary. For each continuous tension segment, the tension direction, cumulative tension value, peak tension location, tension duration, direction holding duration, boundary sensitivity coefficient, and the time interval and intensity difference between it and adjacent continuous tension segments are calculated segment by segment. Based on these parameters, diversion is performed in opposite directions. Specifically, when the tension direction continuously points inward towards the boundary, the cumulative tension value gradually weakens within the continuous window, the direction holding duration continuously increases, and the boundary sensitivity coefficient decreases synchronously, the corresponding continuous action segment is imported into the inward diversion channel in time order. Conversely, when the tension direction continuously points outward towards the boundary, the cumulative tension value gradually increases within the continuous window, the direction holding duration spans multiple analysis windows, and the boundary sensitivity coefficient increases synchronously, the corresponding continuous action segment is imported into the outward diversion channel in time order. Simultaneously, during the import process, consecutive action segments that are temporally adjacent, directional, and have an intensity difference less than a preset threshold are paralleled within their respective channels, forming continuous flow bundles within their respective channels. For consecutive action segments that overlap in time but are in opposite directions, the side with the tension peak position closer to the end of the current window is given priority to occupy the flow splitting boundary, while the action quantity on the other side within the overlapping interval is shortened proportionally to the duration, preventing repeated accumulation of the same time interval in both channels. After completing the paralleling and pruning, flow smoothing is performed on the continuous flow bundles formed in the two channels respectively. Directional jitter caused by short-term fluctuations is reversed and compressed, and amplitude spikes caused by local jumps are limited, so that the flow bundles in the inward channel maintain a continuous contraction trend, and the flow bundles in the outward channel maintain a continuous expansion trend. Finally, the continuous flow bundles in the inward splitting channel, after smoothing and limiting, are packaged into reliable candidate flow data according to the target asset, and the continuous flow bundles in the outward splitting channel, after smoothing and limiting, are packaged into risk candidate flow data according to the target asset.

[0124] Within a unified attachment cycle, trusted candidate stream data and risk candidate stream data are loaded onto their respective mirror attachment coordinate planes, and the two types of candidate streams are synchronized and aligned with the reference mirror boundary, mirror stability interval, and mirror transition interval of the target asset at the same time granularity. Within the trusted side attachment channel, each continuous stream is attached segment by segment along the mirror stability interval in chronological order. For each attached segment, the remaining inner distance between it and the mirror boundary, attachment duration, attachment continuity, and the advance speed along the boundary retraction are simultaneously calculated, ensuring that the trusted side continuous streams form a continuous attachment chain inside the mirror boundary. Within the risk side attachment channel, each continuous stream is attached segment by segment along the mirror transition interval and the outer edge of the mirror boundary in the same chronological order. For each attached segment, the outer deviation distance between it and the mirror boundary, attachment duration, attachment expansion, and the advance speed along the boundary expansion are simultaneously calculated, ensuring that the risk side continuous streams form a continuous attachment chain outside the mirror boundary. After completing the attachment on both sides, the trusted-side attachment chains and risk-side attachment chains that are simultaneously close to the same mirror boundary position within the same time window undergo misalignment correction. For spatially overlapping portions near the boundary, their attachment points are readjusted according to the positional relationship inside and outside the boundary. For temporally compressed portions, their order is rearranged according to duration and advancement speed. For portions intersecting along the boundary direction, a zigzag avoidance rule is applied, prioritizing the inner side and moving the outer side backward. This ensures that the two types of attachment chains remain spatially and temporally separable near the boundary. Then, the trusted-side and risk-side attachment chains, after misalignment correction, undergo continuity calibration. Attachment segments that are temporally adjacent, advance in the same direction, and have a placement distance less than a preset threshold are linked into complete attachment chains within their respective channels. Attachment segments with abrupt changes in advance direction, insufficient duration, or sudden changes in boundary deviation remain disconnected to avoid local jumps that could disrupt the overall attachment structure. Finally, the results of attachment, misalignment correction, and continuity calibration for the trusted and risk sides are uniformly packaged according to the target asset to form dual-domain attachment data.

[0125] Within a unified suppression and rise cycle, the trusted side attachment chain and the risk side attachment chain in the dual-domain attachment data are synchronously loaded into the same cross-domain linkage computing space, and the location of the mirror boundary is used as the linkage baseline, so that the changes of the trusted side attachment chain located inside the baseline and the changes of the risk side attachment chain located outside the baseline can correspond window by window within the same analysis window. Then, for each segment of the trusted-side attachment chain, the continuous attachment duration, the inner boundary advance distance, the attachment continuity, the retraction stability rate, and the boundary suppression difference with the risk-side attachment chain are calculated. For each segment of the risk-side attachment chain, the outer deviation distance, the boundary spillover width, the expansion duration, the attachment expansion degree, and the external expansion gain difference with the trusted-side attachment chain are calculated. Based on the following conditions within the same time window, when the continuous attachment duration of the trusted-side attachment chain increases, the inner boundary advance distance continuously decreases, the retraction stability rate improves, and the external expansion gain difference of the risk side decreases within the corresponding window, the trusted-side attachment chain is weighted upwards, while the corresponding segment of the risk side is suppressed and reduced. When the outer deviation distance of the risk-side attachment chain continuously expands, the boundary spillover width increases, the expansion duration spans multiple windows, and the boundary suppression difference of the trusted side decreases within the corresponding window, the risk-side attachment chain is weighted upwards, while the corresponding segment of the trusted side is suppressed and reduced. After completing the window-by-window opposing up and down adjustment, the local up and down changes caused by short-term back-and-forth tug-of-war in the segments near the boundary where alternating enhancement and weakening occur are then compressed and reversed. For segments that are simultaneously amplified on both sides within the same time window, their gain weights are redistributed according to duration, direction of change, and boundary occupancy ratio to prevent double enhancement of the credible and risky sides in the same local interval. The credible side segments after balance correction are accumulated and integrated according to the uplift weight, suppression residual, continuous holding duration, and shrinkage stability rate to form credible mapping intermediate data. The risky side segments after balance correction are accumulated and integrated according to the uplift weight, suppression residual, outward expansion duration, and boundary spillover width to form risk mapping intermediate data.

[0126] In this embodiment, by first performing tension analysis around the inter-domain coupling boundary, and then completing anisotropic splitting, mirroring, cross-domain suppression, and threshold fixing along the direction inside and outside the boundary, the originally continuous and intertwined change process near the boundary can be split into two independent evolution paths: one along the trust side and the other along the risk side. This ensures that the changes inside and outside the boundary do not overlap in the same computation link. At the same time, after mirroring and cross-domain suppression, the local fluctuations, back-and-forth tug-of-war, and short-term interlaced changes near the boundary will be redistributed and weighted before solidification. This reduces the situation where the dual-domain results are repeatedly amplified or canceled out near the boundary, making the final trust mapping data and risk mapping data clearer in terms of boundary position, continuity, and finalization results.

[0127] In an exemplary embodiment, adaptive takeover is performed on each target asset based on asset trust status data and asset risk status data to obtain asset security operation and management data, including steps 802 to 806. Wherein:

[0128] Step 802: Perform tension and relaxation balancing on the asset credibility status data and asset risk status data to obtain the takeover boundary data corresponding to each target asset.

[0129] Step 804: Based on the takeover boundary data, perform a substitute transfer for each target asset to obtain boundary takeover data.

[0130] Step 806: Based on the boundary takeover data, perform primitive convergence on each target asset to obtain asset security operation and control data.

[0131] Among them, tension and relaxation balancing refers to the process of simultaneously relaxing and tightening the retention range within the boundary and the controlled range outside the boundary based on the dynamic changes between the asset's credibility status and asset risk status within the same control cycle.

[0132] Among them, takeover boundary data refers to the data results formed after tension and relaxation balancing, which are used to record the range that the target asset can continue to bear, the range that must be controlled, the boundary location, the boundary width, and the direction of boundary change.

[0133] Among them, "proxy migration" refers to the process of migrating the requests, calls, sessions and access paths corresponding to the controlled area outside the takeover boundary to the proxy takeover path while maintaining the continuity of processing.

[0134] Among them, boundary takeover data refers to the data results formed after the substitute transfer and takeover fixation, which are used to record the original body's retained path status, the substitute's takenover path status, the boundary switching status, and the rule implementation status.

[0135] Primite Convergence: refers to the process of closing, downgrading, breaking chains, clearing, and minimizing the retention of abilities outside the Primite's side boundary after the Stand takes effect.

[0136] Specifically, asset trust status data and asset risk status data are aligned to the same boundary calculation coordinate system with the same time granularity. Simultaneously, the duration, remaining availability, recovery slope, and contraction magnitude of the continuous stable interval on the trust side are calculated, along with the duration, diffusion gain, boundary expansion magnitude, and cross-link spillover magnitude of the continuous unstable interval on the risk side. Then, the minimum set of capabilities required for continuous business operation is used as the inner retention constraint, and the maximum allowable range of influence for the risk to no longer spread is used as the outer constraint. Under these two constraints, when the trust side remains stable within multiple consecutive control windows, the recovery slope continuously converges inward, and the remaining availability is higher than a preset lower limit, the inner boundary slightly expands outward by a preset step size, appropriately preserving the functional range that can still be supported by the original entity. When the risk side continues to expand outward within multiple consecutive control windows, the diffusion gain continuously accumulates, the boundary expansion magnitude increases, or the cross-link spillover magnitude exceeds a preset threshold, the outer boundary compresses inward by a preset step size, continuously tightening the range of influence that must enter the controlled interval. After each boundary movement, window smoothing and amplitude limiting correction are performed on the difference between the old and new boundaries. Instantaneous jumps occurring only within a single control window are suppressed, and boundary displacements spanning multiple control windows in the same direction are cumulatively retained. Overlapping intervals near the boundary that are simultaneously affected by the credible side's contraction and the risk side's expansion are assigned a single time, ensuring that the same interval is not repeatedly assigned to either the retained or controlled side. Finally, the boundary position, boundary width, retained intervals within the boundary, controlled intervals outside the boundary, boundary change direction, and boundary change rate after tension balancing, amplitude limiting correction, and overlapping interval assignment are solidified into takeover boundary data according to the target asset.

[0137] The takeover boundary data is synchronously written into the traffic scheduling plane, access control plane, session persistence plane, and service routing plane. A dual-path bearer structure is established around the reserved interval within the boundary and the controlled interval outside the boundary. The original path is bound to the reserved interval within the boundary, and the substitute path is bound to the controlled interval outside the boundary. Then, the substitute bearer plane is initialized and deployed on the substitute path side, ensuring compatibility with the original path in terms of external interface address, service port set, protocol interaction order, session identifier format, authentication handshake method, and return result constraints. Boundary mapping relationships are written for each type of controlled request in the routing rules. When the same request enters the control plane, its interval is first determined according to the takeover boundary, and then it is forwarded to the original path or substitute path according to its interval. After the path mapping is completed, for new session requests located in the controlled interval outside the boundary, substitute priority is given to routing. Then, long connection sessions, retry requests, and cross-service call requests are switched in batches according to a preset ratio. During the switching process, the continuity of session identifier, transaction context, and return semantics are maintained synchronously to avoid state loss, protocol breakage, or call loops caused by the transition. During the gradual migration, the request hit rate within the boundary, the request switching rate outside the boundary, the surrogate bearer latency, the original entity's remaining load, and the cross-boundary return traffic are verified window by window. When requests outside the boundary stably fall into the surrogate path within multiple consecutive windows, requests within the boundary stably remain in the original entity path, and the surrogate side's takeover latency does not exceed a preset threshold, the temporary migration rules are updated to formal takeover rules, and the direct access entry points for the corresponding outside-boundary intervals in the original entity path are frozen. Finally, the results of path division, surrogate bearer initialization, gradual migration, session continuity maintenance, boundary transition solidification, and stability verification are uniformly written into the boundary takeover data according to the target assets.

[0138] Within a unified convergence period, boundary takeover data is synchronously written to the network control plane, permission control plane, service execution plane, and session cleanup plane. Primitive convergence strategies are established for two types of control surfaces: the boundary-retained interval and the boundary-migrating interval. For the boundary-migrating interval, external exposed ports, cross-service call entry points, write-type data channels, and high-risk control interfaces on the primitive side are sequentially closed, revoked, downgraded, and disconnected, ensuring that functions migrated to the substitute path no longer retain direct entry points from the primitive. For the boundary-retained interval, only the core service interfaces required for minimum continuous operation, necessary read-only access permissions, basic session processing capabilities, and the minimum execution links necessary to maintain internal state consistency are retained. Then, old sessions, delayed tasks, cached routes, and suspended connections that are still active on the original entity side are cleared window by window. This includes timeout compression and forced removal of old sessions pointing to the migration zone outside the boundary, recycling of expired but not released call chains, refreshing and rebinding of cached routes that may still send traffic back to the original entity, and freezing or rerouting of asynchronous tasks remaining across the boundary. This prevents functions outside the boundary from flowing back to the original entity path after the migration is complete. After clearing at the session, route, and task levels, the original entity's remaining load, in-boundary request hit rate, out-of-boundary return traffic, substitute takeover stability, and actual permission generation efficiency are continuously compared. When out-of-boundary return traffic drops below a preset threshold within multiple consecutive analysis windows, the original entity only carries the reserved zone within the boundary, the substitute side has stably taken over the out-of-boundary migration zone, and permission contraction and network isolation rules remain effective on the original entity side, the current original entity state is solidified as a completed state. Finally, the original interface closed state, original permission contraction state, old session clearing state, route rebinding state, asynchronous task frozen state, substitute takeover stable state, boundary isolation state, and business continuity state are uniformly written into the asset security operation and management data according to the target asset.

[0139] In this embodiment, by first performing tension and relaxation balancing around the change range between the asset's trustworthy state and its risk state, then completing the replacement transfer based on the formed takeover boundary, and finally performing convergence control on the original entity, the takeover action can no longer adopt a "one-size-fits-all" overall isolation approach. Instead, within the same target asset, the boundary range that can continue to be carried out and the boundary range that must be controlled are first divided. Then, the high-risk action surface is transferred to the replacement path and the original entity's exposure surface is compressed simultaneously. This reduces the scope of business interruption caused by directly deactivating the original entity, and also reduces the probability of control failure caused by residual capabilities outside the boundary, old session backflow, and cross-path mixed running. This makes the security control process more suitable for phased implementation in continuous operation scenarios.

[0140] In an exemplary embodiment, based on the takeover boundary data, a substitute transfer is performed on each target asset to obtain boundary takeover data, including steps 902 to 908. Wherein:

[0141] Step 902: Shelling is performed on the boundary constraint bands in the takeover boundary data to obtain the migration cover data corresponding to each target asset.

[0142] Step 904: Based on the migration interface cover data, attach the substitute skeleton to each target asset to obtain the substitute coupling skeleton data.

[0143] Step 906: Based on the substitute coupling skeleton data, perform edge transfer on each target asset to obtain boundary transition takeover data.

[0144] Step 908: Based on the boundary transition takeover data, takeover and fixation are performed on each target asset to obtain boundary takeover data.

[0145] Among them, the boundary constraint band refers to the local takeover boundary section formed in chronological order within a continuous transfer cycle, which includes the boundary location, boundary width, reserved area within the boundary and controlled area outside the boundary.

[0146] Among them, shell stripping refers to the process of splitting and reorganizing the entry constraints, call constraints, session constraints and write constraints in the original execution path that belong to the controlled area outside the boundary into the outer edge of the boundary shell.

[0147] Among them, the interface cover data refers to the interface coverage result data formed after shelling and stripping, which is used to cover the interface range, call range, session continuation range and write transition range outside the boundary of the controlled area.

[0148] Among them, the surrogate skeleton mounting refers to the process of completing the compatible mounting and path alignment of the surrogate carrying framework along the interface range, call range, session range and return range corresponding to the interface cover.

[0149] Among them, the substitute coupling skeleton data refers to the data results formed after the substitute skeleton is mounted, which are used to record the interface coupling, call coupling, session coupling and return path coupling status between the substitute carrier frame and the migration interface cover.

[0150] Among them, edge migration refers to the process of gradually migrating requests, calls, sessions and transactions corresponding to the controlled area outside the takeover boundary from the original path to the substitute path around the location of the takeover boundary.

[0151] Among them, boundary transition takeover data refers to the data results formed after the edge transition, used to record the transition completed interval, the transition waiting interval, the boundary transition status, the session continuation status, and the path switching status.

[0152] Among them, takeover and fixation refers to the process of changing the boundary section that has completed stable relocation from a temporary relocation state to a long-term effective takeover state and simultaneously freezing the corresponding entrance of the original body.

[0153] Specifically, the takeover boundary data is divided into multiple continuous boundary constraint bands with the same time granularity. Within each boundary constraint band, the boundary position, boundary width, reserved interval within the boundary, controlled interval outside the boundary, boundary change rate, boundary direction, and connection length with adjacent bands are calculated synchronously. Around the corresponding external access entry, internal call entry, session maintenance channel, return path channel, and data write channel in each boundary constraint band, the entry constraints, call constraints, session constraints, and write constraints that fall into the controlled interval outside the boundary in the current execution path of the prototype are first segmented along the boundary position so that they are no longer directly attached to the core processing link of the prototype. Then, these segmented constraint intervals are wrapped around the outer edge of the boundary according to the request inbound direction, call outbound direction, return outbound direction, and state maintenance direction, forming a wrapping layer structure around the takeover boundary. After completing the encapsulation, the external access encapsulation layer, internal call encapsulation layer, session persistence encapsulation layer, and write restriction encapsulation layer within the same boundary constraint band are ensured to cover the same control window in time, be spatially adjacent to the same boundary interval, and maintain consistency with the controlled interval outside the boundary in direction. Encapsulation misalignment, overlap, and discontinuity caused by control cycle switching are smoothed, trimmed, and padded respectively, thereby ensuring that the same boundary constraint band forms a continuous, closed, and drift-free interface receiving shell before subsequent substitute mounting. Finally, the processed outer edge receiving shells of each boundary are solidified into migration cover data according to the target asset.

[0154] Migration mask data is loaded onto the external entry plane, internal call plane, session persistence plane, and return path plane, respectively. A substitute bearer framework is established around the interface coverage area, call coverage area, session continuation area, and write transition area corresponding to each migration mask. This substitute bearer framework maintains consistency with the original processing path in terms of interface address, port binding relationship, protocol interaction order, authentication handshake steps, session identifier format, transaction context transmission method, and return result constraints. Migration masks on the external entry plane are mounted for entry, ensuring that new incoming requests within the controlled area outside the boundary first fall into the substitute bearer framework. Migration masks on the internal call plane are mounted for call, directing cross-service calls to the substitute bearer framework when crossing boundaries. Migration masks on the session persistence plane are mounted for session, ensuring continuous session continuation, state retransmission, and token verification within the substitute bearer framework. Migration masks on the return path plane are mounted for return, allowing processing results to be sent back along the predetermined return path without disrupting the original response chain. After completing the four types of mounting, the connection relationships between the surrogate bearer framework and each migration interface cover are compared for consistency in request entry order, call forwarding order, session continuation order, and response return order. Mounting offsets caused by differences in protocol granularity, request rhythm, session refresh cycle, and return path latency are synchronously compensated to ensure that the same request maintains consistent processing order, context continuity, no state loss, and unchanged return results before and after mounting. Furthermore, mounting intervals within adjacent control windows that have completed mounting are linked together in terms of time, interface constraints, and stable context mapping to form the same bearer chain. Mounting intervals where interface constraints have switched, context continuation has been interrupted, or return path conflicts have occurred are kept separate, and independent coupling boundaries are written at the separation points to prevent local anomalies from spreading to the entire bearer chain. Finally, the results of completing entry mounting, call mounting, session mounting, return mounting, coupling correction, and continuity calibration are solidified into surrogate coupling skeleton data according to the target assets.

[0155] The substitute coupling skeleton data is synchronously written into the traffic scheduling plane, service routing plane, session persistence plane, transaction control plane, and access control plane. A boundary transition zone is established around the location of the takeover boundary, so that the reserved interval inside the boundary corresponds to the original processing path, the controlled interval outside the boundary corresponds to the substitute takeover path, and the transition interval near the boundary corresponds to a switchable bidirectional transition path. New requests within the controlled area outside the boundary pass through the boundary turning zone before falling into the substitute coupling skeleton path after entering the scheduling plane. New requests within the reserved area inside the boundary continue to maintain the original direct path. For long-connection sessions, cross-service cascading calls, and transaction requests that have not yet been committed before the migration starts, segmented edge migration is implemented according to the remaining session lifetime, call execution depth, transaction commit stage, and return path occupancy. That is, requests that have not yet entered the critical processing stage are directly diverted to the substitute path. Requests that have entered the intermediate processing stage but have not yet committed results continue to be completed on the original side while the current processing segment is completed. After the current segment ends, the request is switched to the substitute side through the boundary turning zone to take over the subsequent segment. At the same time, requests that have entered the return stage maintain the original return path until completion to avoid processing interruption, transaction rollback, or response link breakage. However, during the migration process, it is also necessary to synchronize and continue the request identifier, session context, token status, transaction sequence number, idempotency flag, return address, and retry count to ensure that the same request maintains context continuity, state continuity, and result continuity before and after the fold. Suppression control is also performed on short-term re-entry, duplicate commits, path loops, and bidirectional hits near the boundary caused by the migration. By setting single fold flags, loop blocking flags, and transition window mutual exclusion rules, it is ensured that the same request only undergoes one valid fold within the same control window. Subsequently, the migration results within the boundary transition zone are continuously compared with the original request hit rate within the boundary, the substitute request hit rate outside the boundary, cross-boundary return traffic, session continuation success rate, transaction integrity rate, protocol anomaly return rate, and average latency after migration. When requests outside the boundary stably fall into the substitute path within multiple consecutive windows, requests within the boundary stably remain in the original path, return traffic and anomaly return rate are both lower than preset thresholds, and session and transaction continuation remain successful, the current migration status is solidified as boundary transition takeover data, including the migration completion interval, the migration stabilization interval, the transition zone effective status, the session continuation status, the transaction continuity status, the path switching status, and the return flow suppression status.

[0156] The boundary transition takeover data is written into the formal traffic routing rule set, formal access control rule set, formal session persistence rule set, formal transaction maintenance rule set, and formal return path rule set, respectively. A three-level fixation order is established according to the transition completion interval, the transition stabilization interval, and the boundary-near swing interval. Among them, the transition completion interval enters the formal fixation process first, the transition stabilization interval enters the delayed fixation process, and the boundary-near swing interval enters the hysteresis observation process. For all controlled requests outside the boundary within the transition completion interval, the entry mapping, call mapping, session continuation mapping, transaction continuation mapping, and return path mapping are switched from temporary transition rules to long-term effective rules, and the direct entry, bypass call entry, old return channel, and legacy session reuse entry in the original path corresponding to this interval are frozen simultaneously, so that the requests that have been migrated out no longer have a direct path to return to the original side. After the formal takeover fixation is completed, the intervals in the transition stabilization interval that maintain a substitute hit rate, session continuation success rate, and transaction continuity rate higher than the preset threshold within multiple consecutive control windows are gradually upgraded. The rules are prioritized, and for intervals that still experience cross-boundary backflow, latency spikes, path mixing, or session re-entry, a dual-track transition state is maintained until the formal fixation conditions are met. For hysteresis fixation control in the swing zone near the boundary, intervals are only allowed to transition from the observation state to the formal fixation state if they maintain the same transition direction, hit result, and context continuation result across multiple consecutive control windows. Intervals experiencing only short-term swings, instantaneous backflows, or local jitter within a single control window retain their existing fixation results to prevent frequent flips in the takeover state near the boundary. After all intervals have completed formal fixation, gradual fixation, or hysteresis fixation, a consistency check is performed on the fixed rule set, continuously comparing the substitute acceptance rate, original body freezing efficiency, old entry closure efficiency, cross-path backflow rate, session duplicate hit rate, transaction double commit rate, and boundary switching stability within the formal takeover intervals. When the above indicators meet the preset stability conditions across multiple consecutive control windows, the current rule state and path state are fixed as the effective takeover state. Finally, the formal takeover zone, the original retention zone, the substitute takeover effective status, the original entry frozen status, the old path closed status, the stagnant and fixed status, the boundary stable status, and the rule consistency verification results are all written into the boundary takeover data according to the target asset.

[0157] In this embodiment, by first forming a migration interface cover around the takeover boundary, then mounting the substitute skeleton on the migration interface cover, and gradually completing the path fixation through edge migration and takeover fixation, the substitute takeover process no longer relies on a one-time overall switch. Instead, an intermediate takeover layer that can be covered, mounted, and transitioned is first established between the original path and the substitute path, thereby reducing protocol mismatch, session breakage, and return link instability caused by direct interface cut-off. At the same time, after edge migration and takeover fixation, the request path in the controlled area outside the boundary can gradually transition from a temporary migration state to a long-term stable takeover state. The corresponding entry on the original side will also be frozen and closed simultaneously. Therefore, the situation of mixed request runs, old path residues, and repeated takeover direction reversals near the boundary is more easily compressed into a local area.

[0158] In an exemplary embodiment, based on asset digital twin data, a time-series graph analysis is performed on the relationships between different target assets to obtain asset time-series relationship graph data, including steps 1002 to 1010. Wherein:

[0159] Step 1002: Extract the evolution bands from the digital twin data of the assets in a folded sequence to obtain the temporal folded data corresponding to each target asset.

[0160] Step 1004: Based on the temporal folding data, perform arc domain back-embedding on the associated slabs between different target assets to obtain cross-asset arc-coupled data.

[0161] Step 1006: Based on the cross-asset arc coupling data, perform link clustering on each target asset to obtain relationship clustering data.

[0162] Step 1008: Based on the relationship clustering data, perform time-scaled weaving on the relationships between different target assets to obtain time-series weaving data.

[0163] Step 1010: Based on the time-series patching data, perform graph fixation on the relationships between different target assets to obtain asset time-series relationship graph data.

[0164] Among them, the evolution band refers to a local time segment formed within a unified analysis period according to the same time granularity, which reflects the continuous change process of the target asset's state.

[0165] Among them, folding and stripping refers to the process of folding, separating, compressing and filling multiple continuously evolving bands in chronological order to form a continuous temporal bending structure.

[0166] Among them, time-series folded data refers to the data results formed after folded stripping, which are used to record the internal time bending trajectory, turning point, duration range and depth of change of the target asset.

[0167] Among them, the related layer refers to the local related interval layer that is distributed within different target assets and can be connected in time or in relationship.

[0168] Arc-domain back-embedding refers to the process of embedding a local time series interval on one target asset into the corresponding interval of another target asset along an arc-shaped connection path to form a continuous cross-asset association.

[0169] Among them, cross-asset arc coupling data refers to the data results formed after arc domain embedding, which are used to record the arc coupling direction, span, bending radius and connection depth between different target assets.

[0170] Link clustering refers to the process of connecting, merging, and grouping multiple cross-asset arc coupling relationships that are interconnected, directionally continuous, and temporally adjacent into a relationship cluster chain.

[0171] Among them, relation clustering data refers to the data results formed after link clustering, which are used to record relation cluster numbers, intra-cluster node sequences, intra-cluster arc sequence sequences, and parallel branch structures.

[0172] Among them, the relationship refers to the connection formed between different target assets during the process of invocation, communication, dependence, control, authorization or data interaction.

[0173] Among them, time-scaled patching refers to the process of splicing, filling, shifting, stitching and limiting the time intervals corresponding to the main chain and branches around the relationship cluster chain.

[0174] Among them, time-series patch data refers to the data results formed after time-scale patching, which are used to record the main time scale line, branch time scale line, continuous time interval and misalignment correction amount.

[0175] Among them, graph fixation refers to the process of fixing the node connection relationships and temporal relationships after time-series weaving into a formal graph structure and completing the consistency verification.

[0176] Specifically, the continuous state change process in the digital twin of the asset is divided into multiple interconnected evolutionary segments according to the same time granularity. Within each evolutionary segment, the configuration change rate, behavior change rate, relationship change rate, lifecycle stage duration, stage switching interval, and time connection length with the preceding and following segments are calculated synchronously. Using the start and end times and change direction of each evolutionary segment as the folding benchmark, when adjacent evolutionary segments are continuous in time, have the same change direction, a change rate difference less than a preset threshold, and a stage switching interval not exceeding a preset window width, they are merged into the same folded continuous segment along the same time bend line. When adjacent evolutionary segments exhibit a reversal of direction, a jump in change rate, a sudden change in stage switching, or a break in time connection, a folding turning boundary is formed at the corresponding position, and the preceding and following segments are separated into different folded segments. Then, secondary corrections are performed on the overlapping areas, short-term reversal areas, and sampling gaps between each fold segment. Specifically, local back-and-forth lines caused by high-frequency short-term fluctuations are reversed and compressed, merging them back into adjacent main fold segments. Local time gaps caused by sampling interval fluctuations are time-added and connected according to the changing slope of consecutive segments. Adjacent fold segments that advance in the same direction but have slightly different fold depths within multiple consecutive windows are smoothed for fold depth, ensuring the fold structure remains continuous on the time axis, distinguishable on the direction axis, and progressively transitioning on the depth axis. Furthermore, for each continuous fold segment, the fold start time, fold end time, fold direction, cumulative fold depth, number of turning points, turning point position, and interval distance with adjacent fold segments are calculated. All continuous fold segments within the same target asset are then rearranged in chronological order, ensuring that gradual changes, abrupt changes, and reversals maintain a corresponding relationship within the same sequence, resulting in time-series fold data.

[0177] For time-series folded intervals arranged in time-series folded data at a uniform time granularity among different target assets, a cross-asset arc domain coordinate plane is established within a unified embedding period. Each target asset's corresponding folded interval is then sequentially placed into different arc segment slots on the arc domain coordinate plane according to its start and end times, fold direction, fold depth, turning point, and interval length with adjacent folds. For adjacent folded intervals that are temporally connectable, have continuous fold directions, fold depth variations within a preset tolerance range, and slot spacing less than a preset arc length threshold, arc domain embedding operations are performed. This embeds the fold tail segment of the preceding target asset into the fold head segment of the following target asset along an arc-shaped transition path. During the embedding process, arc length, bending radius, embedding angle, embedding depth, and cross-asset transition delay are simultaneously calculated, ensuring that the same cross-asset arc segment remains continuous both spatially and temporally. After the first round of embedding is completed, arc segments with consistent curvature, gradual increase or decrease in arc length, continuous embedding angle, and similar transition delay between adjacent cross-asset arc segments are merged to form a single cross-asset arc chain. Arc segments with abrupt changes in curvature, jumps in arc length, sudden changes in embedding depth, or transition delays exceeding a preset range are separated by arc breaking. The cross-asset connection breakpoint, the order of assets before and after the breakpoint, and the time of the breakpoint are recorded at the breakpoint location to prevent local discontinuities from spreading to the entire cross-asset chain. For each cross-asset arc chain after merging or breaking arcs, lateral translation compensation is performed for embedding slot misalignment caused by sampling period switching, short-segment reconnection is performed for arc segment discontinuities caused by local time gaps, and layer rearrangement is performed for arc segment intersections caused by concurrent folds merging into the same target asset. This ensures that different cross-asset arc chains maintain spatial separation and clear temporal order within the same coordinate plane, resulting in cross-asset arc coupling data.

[0178] All cross-asset arc coupling relationships related to the target asset in the cross-asset arc coupling data are arranged into a continuous operation sequence according to the occurrence time, coupling direction, arc length span, bending radius, and endpoint sequence. The target asset is used as the current clustering center to establish a main chain channel and a parallel chain channel. Arc segments with seamless beginning and end times, consistent direction, arc length span variation within a preset tolerance range, and endpoints continuously advancing within adjacent analysis windows are preferentially connected sequentially along the main chain channel to form the same relationship cluster chain. Multiple arc segments that simultaneously enter the current target asset or are simultaneously emitted by the current target asset within the same time window are arranged in parallel within the parallel chain channel according to their arrival order, directional angle, and duration, forming parallel branches extending around the main chain. For each arc segment already in the same relation cluster chain, intra-cluster reordering is performed to prevent local round trips of arc segments with brief temporal swings but unchanged overall direction from being repeatedly counted in the overall path length. Short arc segments that only appear in a single analysis window and cannot form a continuous connection with the preceding and following arc segments are removed as isolated segments. For redundant arc segments that cross too many intermediate assets but have insufficient duration and lack a stable temporal relationship with adjacent arc segments, their weights are reduced and they are removed from the main chain channel to prevent localized sporadic associations from lengthening the entire cluster chain. After completing the main chain concatenation, parallel chain arrangement, foldback compression, isolated segment removal, and redundant segment weight reduction, adjacent branches within the same relation cluster chain that are temporally adjacent, have the same endpoint advancement direction, and have a gradual increase in arc length are merged and reorganized to form a parallel bundle with structural convergence before subsequent time-scale patching. Branches with abrupt changes in direction, continuous breaks, or significant jumps in endpoint position are kept separate, and the branch breakpoint and corresponding time section are written at the separation position to obtain relation clustering data.

[0179] The start time, end time, duration, adjacent intervals, and overlapping intervals of parallel branches for each node in the relation clustering data are loaded onto the same time-scale coordinate plane at the same time granularity. A main timeline is established along the main propagation direction of the relation cluster, and branch timelines are established along the parallel branches, so that the main chain advancement process and the branch differentiation process correspond to each other window by window under the same time reference. Time-interpolation splicing is performed on adjacent intervals in the main timeline that are connected end to end but have short time gaps, so that the time breaks between the two intervals are connected according to the preset compensation width. For intervals with too short a duration but repeated in multiple adjacent windows and with the same direction of change, segment accumulation is performed to merge them into the preceding and following main lines to form a longer continuous time period. Simultaneously, segments within the branch timescale that advance synchronously with the main timescale within the same time window are aligned and stitched together, ensuring that branch segments share a unified window boundary and advancement rhythm with the main chain segments. Branch segments that are ahead or behind the main chain are compensated for their time deviations by translation, maintaining a comparable time position with the main chain without altering their original sequence. Finally, time misalignments caused by sampling frequency differences across the entire timescale coordinate plane are smoothed out through window reallocation. Time gaps caused by lost local events are filled by extending adjacent continuous intervals. Parallel branch changes that occur repeatedly within the same time window and have the same direction are limited and merged to prevent the accumulation of local repetitions from amplifying the overall time length. Based on this, the main timeline and branch timeline after the repair are checked as a whole in terms of time continuity, direction consistency and segment connection integrity. Local segments that still have breaks, back jumps or overlapping conflicts are recut and backfilled into adjacent continuous intervals until the main chain and branch chain in the same relation cluster form a continuous, aligned timeline structure without obvious time breaks, thus obtaining time-series patch data.

[0180] The main timeline, branch timelines, node sequences, and arc sequences of the time-series patch data are synchronously written into the graph structure space, and a set of connections to be fixed is established according to the connection direction, duration, and sequential connection relationship between the target assets. Then, the connection stability within multiple consecutive analysis windows is used as the fixing threshold. For connection intervals that maintain convergence in time position, consistent connection direction, duration variation below a preset threshold, and no more frequent increases or decreases in the number of branches, formal fixing is performed, transforming these connection relationships from a variable state to a fixed state, and locking their start node, end node, edge direction, duration, and corresponding timeline position within the graph structure space. Hysteresis fixing control is performed on connection intervals that still exhibit local oscillations. That is, the same connection interval is only allowed to enter the formal fixing state if it maintains the same direction, similar duration, and the same branch attachment position within multiple consecutive fixing windows. Connection intervals that only experience short-term offsets, short-term disconnections, or short-term branch increases or decreases within a single window remain in a transitional state to prevent graph edges from repeatedly flipping between adjacent windows. Furthermore, loop pruning is performed on connection intervals that form closed loops in time and conflict with each other in direction. For cases where bidirectional connections occur simultaneously between the same node pairs within the same duration interval, unidirectional rearrangement is implemented. For graph breakpoints caused by local branch detachment, nodes are reconnected according to consecutive timescales. Parallel edges repeatedly fixed to the same node pair within the same time window are merged and limited. This ensures that any connection relationship in the graph remains unique and continuous in direction, duration, and attachment structure. Finally, the results of formal fixing, hysteresis control, consistency verification, loop pruning, unidirectional rearrangement, node reconnection, and parallel edge merging are uniformly written into the asset time-series relationship graph data according to the target asset.

[0181] In this embodiment, by first extracting the evolution process within each target asset in a folded order, and then performing arc domain embedding, link clustering, time-scale patching, and graph fixation between different target assets, the local changes originally scattered in the local evolution sequences of each asset can be reorganized into a cross-asset, cross-time, and directionally continuous relational structure. This avoids the link breaks and time misalignments caused by establishing a relational graph based solely on static relational edges or single time-series fragments. At the same time, after link clustering and time-scale patching, the time discontinuities caused by concurrent branches, short time holes, local bounces, and sampling frequency differences are corrected in advance before the graph is finalized. Therefore, the final asset time-series relational graph is more complete in terms of cross-asset propagation order, parallel branch relationships, and continuous interval connections. This reduces misjudgments caused by relation fragmentation and time discontinuities when conducting propagation analysis, boundary calculation, and state calculation around the graph.

[0182] In one exemplary embodiment, a computer device is provided, which may be a cloud platform, and its internal structure diagram may be as follows: Figure 3As shown. This computer device includes a processor, memory, input / output interfaces (I / O), and communication interfaces.

[0183] Those skilled in the art will understand that Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0184] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0185] In one embodiment, a computer-readable storage medium is provided storing a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0186] In one embodiment, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and executes the computer instructions, causing the computer device to perform the steps in the above method embodiments.

[0187] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0188] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above methods.

[0189] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0190] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for managing and controlling secure operational assets based on a cloud platform, characterized in that, The method includes: Evidence fusion is performed on resource status data and security behavior data in the cloud platform to obtain candidate asset object data; Based on the candidate asset object data, a digital twin model is performed on each target asset in the cloud platform to obtain asset digital twin data; Based on the digital twin data of the assets, a time-series graph analysis is performed on the correlation between different target assets to obtain asset time-series relationship graph data; Based on the asset digital twin data and the asset time-series relationship graph data, a trust status analysis is performed on each of the target assets to obtain asset trust status data and asset risk status data. Based on the asset trust status data and the asset risk status data, adaptive takeover is performed on each of the target assets to obtain asset security operation and management data.

2. The method according to claim 1, characterized in that, The step involves performing a credibility status analysis on each target asset based on the asset digital twin data and the asset time-series relationship graph data to obtain asset credibility status data and asset risk status data, including: The temporal correlation edges in the asset temporal relationship graph data are reversed and folded to obtain the risk convergence trajectory data corresponding to each target asset. Based on the risk convergence trajectory data and the asset digital twin data, a mirror difference analysis is performed on each of the target assets to obtain credible disturbance data; Based on the trusted perturbation data, trusted risk dual-domain mapping is performed on each of the target assets to obtain the trusted status data of the assets and the risk status data of the assets.

3. The method according to claim 2, characterized in that, The step involves performing mirror difference analysis on each of the target assets based on the risk convergence trajectory data and the asset digital twin data to obtain reliable perturbation data, including: Echo deconvolution is performed on the temporal propagation segments in the risk convergence trajectory data to obtain disturbance response contour data. The steady-state attribute data, variable dynamic attribute data, and relational attribute data in the asset digital twin data are subjected to twin stripping and reconstruction to obtain reference mirror data; Based on the disturbance response contour data and the reference mirror data, disturbance projection difference processing is performed on each of the target assets to obtain the reliable disturbance data.

4. The method according to claim 3, characterized in that, The step of performing perturbation projection difference processing on each of the target assets based on the perturbation response contour data and the reference mirror data to obtain the reliable perturbation data includes: Projection consolidation is performed on the steady-state mirror layers in the reference mirror data to obtain mirror anchor domain data; Angular domain expansion is performed on the temporal perturbation lobes in the perturbation response contour data to obtain perturbation projection stream data; Based on the mirrored anchor domain data and the disturbance projection flow data, off-axis compensation is performed on each of the target assets to obtain differential coupling data; Based on the differential coupling data, credible perturbation extraction is performed on each of the target assets to obtain the credible perturbation data.

5. The method according to claim 2, characterized in that, The step of performing a trusted risk dual-domain mapping on each of the target assets based on the trusted perturbation data to obtain the asset trusted status data and the asset risk status data includes: The perturbation components in the credible perturbation data are reverse-phased to obtain the inter-domain coupling boundary data corresponding to each target asset; Based on the inter-domain coupling boundary data, dual-domain splitting is performed on each of the target assets to obtain trusted mapping data and risk mapping data. Based on the trusted mapping data and the risk mapping data, a state convergence analysis is performed on each of the target assets to obtain the asset trusted state data and the asset risk state data.

6. The method according to claim 5, characterized in that, The step of performing dual-domain split mapping on each of the target assets based on the inter-domain coupling boundary data to obtain trusted mapping data and risk mapping data includes: Tension analysis is performed on the boundary transition components in the inter-domain coupling boundary data to obtain the inter-domain tension data corresponding to each target asset. Based on the inter-domain tension data, each of the target assets is divided into different directions to obtain credible candidate flow data and risk candidate flow data. Based on the trusted candidate stream data and the risk candidate stream data, each of the target assets is mirrored and attached to obtain dual-domain attachment data. Based on the dual-domain connection data, cross-domain suppression and enhancement are performed on each of the target assets to obtain trusted mapping intermediate data and risk mapping intermediate data. Based on the trusted mapping intermediate data and the risk mapping intermediate data, each of the target assets is assigned a domain value to obtain the trusted mapping data and the risk mapping data.

7. The method according to claim 1, characterized in that, The adaptive takeover of each target asset based on the asset trust status data and the asset risk status data, to obtain asset security operation and management data, includes: The asset trust status data and the asset risk status data are balanced to obtain the takeover boundary data corresponding to each target asset. Based on the takeover boundary data, substitutes are transferred to each of the target assets to obtain boundary takeover data. Based on the boundary takeover data, the target assets are aggregated to obtain the asset security operation and management data.

8. The method according to claim 7, characterized in that, The step of performing a substitute transfer on each of the target assets based on the takeover boundary data to obtain boundary takeover data includes: Shelling is performed on the boundary constraint bands in the takeover boundary data to obtain the relocation cover data corresponding to each target asset. Based on the migration mask data, substitute skeletons are attached to each of the target assets to obtain substitute coupling skeleton data. Based on the substitute coupling skeleton data, each of the target assets is folded and transferred to obtain boundary transition takeover data. Based on the boundary transition takeover data, takeover and fixation are performed on each of the target assets to obtain the boundary takeover data.

9. The method according to claim 1, characterized in that, The step involves performing a time-series graph analysis on the relationships between different target assets based on the asset digital twin data to obtain asset time-series relationship graph data, including: The evolution bands in the digital twin data of the assets are stripped in sequence to obtain the temporal fold data corresponding to each target asset; Based on the temporal folding data, arc domain back-embedding is performed on the associated slabs between different target assets to obtain cross-asset arc-coupled data. Based on the cross-asset arc coupling data, link clustering is performed on each of the target assets to obtain relationship clustering data; Based on the relationship clustering data, time-scaled weaving is performed on the association relationships between different target assets to obtain time-series weaving data; Based on the time-series patch data, the relationships between different target assets are fixed in a graph to obtain the asset time-series relationship graph data.

10. A cloud-based secure operation asset management system, characterized in that, The system includes: a cloud platform and a terminal; The cloud platform is used to perform evidence fusion on resource status data and security behavior data in the cloud platform to obtain candidate asset object data; the resource status data and the security behavior data are collected through the terminal. The cloud platform is used to perform twin modeling on each target asset in the cloud platform based on the candidate asset object data, so as to obtain asset digital twin data; The cloud platform is used to perform time-series graph analysis on the relationship between different target assets based on the asset digital twin data, and obtain asset time-series relationship graph data; The cloud platform is used to perform a trust status analysis on each of the target assets based on the asset digital twin data and the asset time-series relationship graph data, so as to obtain asset trust status data and asset risk status data. The cloud platform is used to adaptively take over each of the target assets based on the asset trust status data and the asset risk status data, thereby obtaining asset security operation and management data.

Images