CN116796310B - Data attack processing method and system applied to intelligent cloud - Google Patents

Data attack processing method and system applied to intelligent cloud Download PDF

Info

Publication number
CN116796310B
CN116796310B CN202310703547.7A CN202310703547A CN116796310B CN 116796310 B CN116796310 B CN 116796310B CN 202310703547 A CN202310703547 A CN 202310703547A CN 116796310 B CN116796310 B CN 116796310B
Authority
CN
China
Prior art keywords
data
attack
event
knowledge
historical
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN202310703547.7A
Other languages
Chinese (zh)
Other versions
CN116796310A (en
Inventor
郭萍
赵启东
包林陇
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Shanghai Ruiji Computer Technology Co ltd
Original Assignee
Shanghai Ruiji Computer Technology Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shanghai Ruiji Computer Technology Co ltd filed Critical Shanghai Ruiji Computer Technology Co ltd
Priority to CN202310703547.7A priority Critical patent/CN116796310B/en
Publication of CN116796310A publication Critical patent/CN116796310A/en
Application granted granted Critical
Publication of CN116796310B publication Critical patent/CN116796310B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55Detecting local intrusion or implementing counter-measures
    • G06F21/554Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/30Information retrieval; Database structures therefor; File system structures therefor of unstructured textual data
    • G06F16/35Clustering; Classification
    • G06F16/355Class or cluster creation or modification
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/30Information retrieval; Database structures therefor; File system structures therefor of unstructured textual data
    • G06F16/36Creation of semantic tools, e.g. ontology or thesauri
    • G06F16/367Ontology
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00Pattern recognition
    • G06F18/20Analysing
    • G06F18/23Clustering techniques
    • G06F18/232Non-hierarchical techniques
    • G06F18/2321Non-hierarchical techniques using statistics or function optimisation, e.g. modelling of probability density functions
    • G06F18/23213Non-hierarchical techniques using statistics or function optimisation, e.g. modelling of probability density functions with fixed number of clusters, e.g. K-means clustering
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55Detecting local intrusion or implementing counter-measures
    • G06F21/552Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55Detecting local intrusion or implementing counter-measures
    • G06F21/56Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/561Virus type analysis

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • General Physics & Mathematics (AREA)
  • Data Mining & Analysis (AREA)
  • Computer Hardware Design (AREA)
  • Virology (AREA)
  • Databases & Information Systems (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Computational Linguistics (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Animal Behavior & Ethology (AREA)
  • Evolutionary Computation (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Artificial Intelligence (AREA)
  • Evolutionary Biology (AREA)
  • General Health & Medical Sciences (AREA)
  • Probability & Statistics with Applications (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

The invention relates to the technical field of artificial intelligence, and discloses a data attack processing method and system applied to intelligent cloud, wherein the method comprises the following steps: knowledge extraction is carried out on the historical attack data of the intelligent cloud, so that knowledge data of the historical attack data are obtained; carrying out data fusion on the knowledge data to obtain fusion data of the knowledge data, and generating a historical knowledge graph of historical attack data according to the fusion data; acquiring real-time attack events of the intelligent cloud, and generating event attack numbers of the real-time attack events according to a preset attack number algorithm; generating an attack path of a real-time attack event, and carrying out map updating on the historical knowledge map according to the attack path and the event attack number to obtain an updated knowledge map of the historical knowledge map; and generating an intrusion attack sequence of the intelligent cloud according to the updated knowledge graph, and carrying out data attack processing on the intelligent cloud by utilizing the intrusion attack sequence. The method and the device can improve the accuracy of data attack processing applied to the intelligent cloud.

Description

Data attack processing method and system applied to intelligent cloud
Technical Field
The invention relates to the technical field of artificial intelligence, in particular to a data attack processing method and system applied to intelligent cloud.
Background
With the continued advancement of digitization technology, global digitization has advanced into the acceleration phase. Under the double drive of national strategic general support and the positive digital transformation of enterprises, more and more enterprises migrate the service to the cloud. The smart cloud is convenient, fast and convenient, and has high cost performance and elasticity, but once some smart cloud leaks the data privacy of the user, or the data is lost in a large amount due to equipment failure in the cloud storage process, or the data is tampered by other users at will in the transmission process, the adverse effect caused by the result is difficult to measure, and how to effectively realize the protection treatment of the data attack is the important work of the security of the smart cloud.
At present, the security protection of the intelligent cloud has a certain limitation, the accuracy of attack processing is difficult to be guaranteed, so that error data attack processing is extremely easy to generate, and therefore, how to improve the accuracy of the data attack processing applied to the intelligent cloud becomes a problem to be solved urgently.
Disclosure of Invention
The invention provides a data attack processing method and system applied to an intelligent cloud, and mainly aims to solve the problem of low accuracy in data attack processing of the intelligent cloud.
In order to achieve the above object, the present invention provides a data attack processing method applied to a smart cloud, including:
Acquiring historical attack data of the intelligent cloud, and carrying out knowledge extraction on the historical attack data according to the data type of the historical attack data to obtain knowledge data of the historical attack data;
carrying out data fusion on the knowledge data to obtain fusion data of the knowledge data, and generating a historical knowledge graph of the historical attack data according to the fusion data;
Acquiring a real-time attack event of the intelligent cloud, and generating an event attack number of the real-time attack event according to a preset attack number algorithm, wherein the preset attack number algorithm is as follows:
Wherein J (U, V) is the sum of squares of distances from the event features of the real-time attack event to the cluster center in each category, min (x) is a minimum function, n is the total number of features of the event features of the real-time attack event, c is a specified classification number of the event features, U ik is a matrix element m of an ith row and a kth column in a fuzzy classification matrix generated by the time features is a degree coefficient, x k is the kth event feature, V i is the ith cluster center, i is a feature identifier of the event feature, k is a category identifier of the cluster center, U is a fuzzy classification matrix generated by the time features, and V is a set of the cluster centers;
Generating an attack path of the real-time attack event, and carrying out spectrum updating on the historical knowledge spectrum according to the attack path and the event attack number to obtain an updated knowledge spectrum of the historical knowledge spectrum;
And generating an intrusion attack sequence of the intelligent cloud according to the updated knowledge graph, and carrying out data attack processing on the intelligent cloud by utilizing the intrusion attack sequence.
Optionally, the knowledge extraction is performed on the historical attack data according to the data type of the historical attack data to obtain knowledge data of the historical attack data, including:
Determining a data format of the historical attack data according to a data source of the historical attack data, and determining a data type of the historical attack data according to the data format, wherein the data type is structured data and unstructured data;
Performing triplet conversion on the structured data to obtain triplet data of the structured data;
and extracting information from the unstructured data to obtain information data of the unstructured data, and collecting the triplet data and the information data as knowledge data of the historical attack data.
Optionally, the performing triplet conversion on the structured data to obtain triplet data of the structured data includes:
performing data mapping on the structured data to obtain mapping data of the structured data;
performing data selection on the mapping data according to a preset ternary label to obtain target data of the mapping data;
and determining the corresponding relation of the target data, and generating the triple data of the structured data according to the corresponding relation and the target data.
Optionally, the extracting information from the unstructured data to obtain information data of the unstructured data includes:
performing word segmentation processing on the unstructured data to obtain data word segmentation of the unstructured data;
Performing body extraction on the unstructured data according to the data word segmentation to obtain body data of the unstructured data;
Performing entity extraction on the unstructured data according to the data word segmentation to obtain entity data of the unstructured data;
And generating information data of the unstructured data according to the body data and the entity data.
Optionally, the data fusion of the knowledge data to obtain fusion data of the knowledge data includes:
carrying out semantic extraction on the knowledge data to obtain knowledge semantics of the knowledge data;
Performing entity association on entity data of the knowledge data according to the knowledge semantics to obtain associated data of the entity data;
and carrying out data fusion on the knowledge data according to the associated data to obtain fusion data of the knowledge data.
Optionally, the generating the historical knowledge-graph of the historical attack data according to the fusion data includes:
generating initial nodes of the historical attack data according to the ontology data in the fusion data;
Determining a node label of the initial node, and performing branch configuration on the initial node according to the node label and the fusion data to obtain a child node of the initial node;
And generating a historical knowledge graph of the historical attack data according to the initial node and the child node.
Optionally, the generating the event attack number of the real-time attack event according to a preset attack number algorithm includes:
extracting features of the real-time attack event to obtain event features of the real-time attack event;
Performing feature clustering on the event features by using a preset attack number algorithm to obtain clustered features of the event features;
and generating the event attack number of the implementation attack event according to the cluster characteristics.
Optionally, the generating the attack path of the real-time attack event includes:
extracting paths of the real-time attack events to obtain event paths of the real-time attack events;
and effectively identifying the event path to obtain an attack path of the event path.
Optionally, the performing, according to the attack path and the number of the attacks, a graph update on the historical knowledge graph to obtain an updated knowledge graph of the historical knowledge graph includes:
Obtaining path weight of the attack path, and generating a real-time attack weight of the real-time attack event by using a preset attack weight algorithm, the path weight and the event attack number, wherein the preset attack weight algorithm is as follows:
Wherein, P is a real-time attack weight of the real-time attack event, w j is the jth path weight, delta j is the number of the event attacks corresponding to the jth path weight, j is the identification of the number of the event attacks, and T is the total number of the event attacks;
and carrying out spectrum updating on the historical knowledge spectrum by utilizing the real-time attack weight to obtain an updated knowledge spectrum of the historical knowledge spectrum.
In order to solve the above problems, the present invention further provides a data attack processing system applied to a smart cloud, the system comprising:
The knowledge extraction module is used for acquiring historical attack data of the intelligent cloud, and carrying out knowledge extraction on the historical attack data according to the data type of the historical attack data to obtain knowledge data of the historical attack data;
The data fusion module is used for carrying out data fusion on the knowledge data to obtain fusion data of the knowledge data, and generating a historical knowledge graph of the historical attack data according to the fusion data;
The attack number generation module is used for acquiring the real-time attack event of the intelligent cloud and generating the event attack number of the real-time attack event according to a preset attack number algorithm, wherein the preset attack number algorithm is as follows:
Wherein J (U, V) is the sum of squares of distances from the event features of the real-time attack event to the cluster center in each category, min (x) is a minimum function, n is the total number of features of the event features of the real-time attack event, c is a specified classification number of the event features, U ik is a matrix element m of an ith row and a kth column in a fuzzy classification matrix generated by the time features is a degree coefficient, x k is the kth event feature, V i is the ith cluster center, i is a feature identifier of the event feature, k is a category identifier of the cluster center, U is a fuzzy classification matrix generated by the time features, and V is a set of the cluster centers;
the pattern updating module is used for generating an attack path of the real-time attack event, and carrying out pattern updating on the historical knowledge pattern according to the attack path and the event attack number to obtain an updated knowledge pattern of the historical knowledge pattern;
and the attack processing module is used for generating an intrusion attack sequence of the intelligent cloud according to the updated knowledge graph, and carrying out data attack processing on the intelligent cloud by utilizing the intrusion attack sequence.
According to the embodiment of the invention, knowledge extraction is carried out on historical attack data of the intelligent cloud to obtain knowledge data of the historical attack data, the knowledge extraction is carried out for generating data characteristics of the historical attack data, and the data fusion is carried out on the knowledge data to generate the historical knowledge map of the historical attack data of the intelligent cloud according to fusion data generated by data fusion, wherein the historical knowledge map simply and clearly shows the attribute and the attribute value of the historical attack data, the historical knowledge map is subjected to map updating by utilizing a real-time attack event, the knowledge map of the intelligent cloud is ensured to have instantaneity, the intelligent cloud can be more accurately described by the updated knowledge map through a data feedback form, and the intelligent cloud is subjected to data attack processing according to the updated knowledge map, so that the updated knowledge map shows the attack degree and the attack path so as to accurately cope with the attack.
Drawings
Fig. 1 is a flow chart of a data attack processing method applied to a smart cloud according to an embodiment of the present invention;
FIG. 2 is a flow chart of knowledge data for generating historical attack data according to an embodiment of the present invention;
FIG. 3 is a flow chart of generating information data of unstructured data according to an embodiment of the present invention;
FIG. 4 is a functional block diagram of a data attack processing system applied to a smart cloud according to an embodiment of the present invention;
The achievement of the objects, functional features and advantages of the present invention will be further described with reference to the accompanying drawings, in conjunction with the embodiments.
Detailed Description
It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the scope of the invention.
The embodiment of the application provides a data attack processing method applied to an intelligent cloud. The execution body of the data attack processing method applied to the smart cloud comprises at least one of a server, a terminal and the like which can be configured to execute the method provided by the embodiment of the application. In other words, the data attack processing method applied to the smart cloud may be performed by software or hardware installed in a terminal device or a server device, and the software may be a blockchain platform. The service end includes but is not limited to: a single server, a server cluster, a cloud server or a cloud server cluster, and the like. The server may be an independent server, or may be a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (Content Delivery Network, CDN), and basic cloud computing services such as big data and artificial intelligence platforms.
Referring to fig. 1, a flow chart of a data attack processing method applied to a smart cloud according to an embodiment of the invention is shown. In this embodiment, the data attack processing method applied to the smart cloud includes:
s1, acquiring historical attack data of the intelligent cloud, and performing knowledge extraction on the historical attack data according to the data type of the historical attack data to obtain knowledge data of the historical attack data.
In the embodiment of the invention, the intelligent cloud can effectively manage the information of the enterprise, and many businesses of the enterprise can be managed by using the intelligent cloud, for example: office business, sales business, purchasing business, inventory business, customer management, project management, personnel management, training management, cost management, key performance indicators, and the like.
In detail, the historical attack data of the acquired smart cloud may be a message collection tool (for example, a tool such as a thumb, a Kafka, etc.) known in the art, and the thumb and the Kafka tool are merely exemplary examples for illustrating the implementation of the solution, and do not limit the solution to the necessity of using the thumb and the Kafka tool.
In detail, kafka is an open source stream processing platform developed by the Apache software foundation, a high throughput distributed publish-subscribe messaging system that can process all action stream data of consumers in websites.
In detail, the data types are divided into structured data and unstructured data, the unstructured data is divided into semi-structured data and plain text data, wherein the structured data generally refers to data which can be represented and stored by using a relational database and can be logically represented and realized by using a two-dimensional table, and the unstructured data can be from research reports, academic journals, public blogs and the like; the structured data is from large databases.
In the embodiment of the present invention, as shown in fig. 2, the knowledge extraction is performed on the historical attack data according to the data type of the historical attack data to obtain knowledge data of the historical attack data, including:
S21, determining a data format of the historical attack data according to a data source of the historical attack data, and determining a data type of the historical attack data according to the data format, wherein the data type is structured data and unstructured data;
s22, performing triplet conversion on the structured data to obtain triplet data of the structured data;
S23, extracting information from the unstructured data to obtain information data of the unstructured data, and collecting the triplet data and the information data as knowledge data of the historical attack data.
In detail, the data sources of the historical attack data include the database, research reports, academic journals, public blogs, and the like; the data format includes: tables, picture files, plain files, binary files, audio formats, video formats, and the like.
In detail, the unstructured data is data with irregular or incomplete data structure, no predefined data model and inconvenient to be represented by a two-dimensional logic table of a database, including office documents, texts, pictures, HTML, various reports, images, audio/video information and the like in all formats.
In detail, the performing the triplet conversion on the structured data to obtain triplet data of the structured data includes:
performing data mapping on the structured data to obtain mapping data of the structured data;
performing data selection on the mapping data according to a preset ternary label to obtain target data of the mapping data;
and determining the corresponding relation of the target data, and generating the triple data of the structured data according to the corresponding relation and the target data.
In detail, the preset ternary label refers to an attribute of the mapping data, an attribute value of the mapping data, and a resource of the mapping data, where the ternary label data may be represented by a table, for example: the columns of the table are used as attributes of the mapping data, the rows of the table are used as resources of the mapping data, the cell values of the table are used as literal amounts of the mapping data, and the tables can be used as classes in the body of the structured data, and the resources are also called as entities in the mapping data.
Further, the triplet data may be represented by nodes and edges, where the nodes represent entities and attributes in the mapping data, and the edges represent relationships between entities and corresponding relationships between entities and attributes, where the corresponding relationships of the target data refer to relationships between entities and attributes.
In detail, the triplet data is used to represent a relationship between entities, or what an attribute value of a certain attribute of an entity is, and the structure of the triplet is "resource-attribute value" from the content, where an entity is represented by a uniform resource identifier, and an attribute value may be a uniform resource identifier of another entity, or may be a value of a certain data type, which is also called literal quantity.
In detail, referring to fig. 3, the extracting information from the unstructured data to obtain information data of the unstructured data includes:
S31, performing word segmentation processing on the unstructured data to obtain data word segmentation of the unstructured data;
S32, carrying out body extraction on the unstructured data according to the data word segmentation to obtain body data of the unstructured data;
s33, carrying out entity extraction on the unstructured data according to the data word segmentation to obtain entity data of the unstructured data;
S34, generating information data of the unstructured data according to the body data and the entity data.
In detail, the word segmentation process on the unstructured data may be a word segmentation tool (for example, may be a tool such as jieba, snowNLP, pkuSeg, THULAC, hanLP) which is known in the art, and the jieba, snowNLP, pkuSeg, THULAC, hanLP tool is merely an exemplary example for illustrating the implementation of the solution, and does not limit that the solution must employ the jieba, snowNLP, pkuSeg, THULAC, hanLP tool.
In detail, the extracting the ontology from the unstructured data according to the data word segmentation refers to determining the ontology data in the unstructured data, wherein the ontology is a collection of concepts and is a well-known concept framework, and generally refers to that the concept such as 'people', 'things', 'places', 'organizations' are not changed, the ontology can be called as class in object-oriented programming, and the ontology can be called as metadata in data management.
In detail, the entity extraction of the unstructured data according to the data word segmentation refers to determining entity data in the unstructured data, wherein the entity is integration of an entity, an instance and a relationship, for example, "person" is a concept in an entity frame, related attributes such as "gender" are also specified in the concept, and a Ming is a specific person, called an instance, so that Ming also has gender, and Ming and an entity concept "person" embodying Ming and related attributes are called an entity.
S2, carrying out data fusion on the knowledge data to obtain fusion data of the knowledge data, and generating a historical knowledge graph of the historical attack data according to the fusion data.
In the embodiment of the invention, the historical knowledge graph is a graph organization form for representing the association relation and the data weight of the historical attack data, various entities are associated through semantic association, and structured and unstructured data are extracted and fused together through the knowledge graph, so that the utilization and migration of large-scale data are facilitated.
In detail, the historical knowledge graph of the historical attack data is obtained by extracting information such as entities, attributes, relations and the like of the historical attack data and then obtaining high-quality data with more clear disambiguation and relation through a knowledge fusion step.
In the embodiment of the present invention, the data fusion is performed on the knowledge data to obtain the fused data of the knowledge data, including:
carrying out semantic extraction on the knowledge data to obtain knowledge semantics of the knowledge data;
Performing entity association on entity data of the knowledge data according to the knowledge semantics to obtain associated data of the entity data;
and carrying out data fusion on the knowledge data according to the associated data to obtain fusion data of the knowledge data.
In detail, the semantic extraction of the knowledge data may utilize bert models.
In detail, the entity association of the entity data of the knowledge data according to the knowledge semantics refers to determining the relationship between the entity and the relationship between the entity and the entity according to the knowledge semantics.
In detail, the data fusion of the knowledge data according to the association data may use a bayesian estimation method, where the bayesian estimation method is a method for calculating posterior probability according to priori knowledge of an observation space, so as to realize identification of a target in the observation space, and the bayesian estimation method is easy to understand and has small calculation amount; the data fusion of the knowledge data according to the associated data may also use a maximum likelihood estimation algorithm, where the fused data is taken as an estimated value for making a likelihood function reach an extremum, and the maximum likelihood estimation algorithm has less information loss and is suitable for fusing the knowledge data.
In an embodiment of the present invention, the generating, according to the fusion data, a historical knowledge graph of the historical attack data includes:
generating initial nodes of the historical attack data according to the ontology data in the fusion data;
Determining a node label of the initial node, and performing branch configuration on the initial node according to the node label and the fusion data to obtain a child node of the initial node;
And generating a historical knowledge graph of the historical attack data according to the initial node and the child node.
In detail, the initial node generating the historical attack data according to the ontology data in the fusion data refers to determining a classification category of the historical attack data according to the ontology data, wherein the ontology represented by the ontology data is the classification category of the historical attack data; the classification category represents the ontology of the historical knowledge graph, and the determining of the node label of the initial node refers to assigning an identifying label to the initial node, wherein the node label is used for distinguishing different initial nodes and distinguishing different ontologies.
In detail, the ontology is formalized expression of a set of concepts and relationships thereof in a specific field, the ontology of the historical knowledge graph can be understood as a data mode of the knowledge graph, and can be generally described as a semantic network, which types of entities exist in the historical knowledge graph, which types of attributes exist in each type of entity, and which types of relationships exist among various types of entities are described.
In detail, the step of performing branch configuration on the initial node according to the node tag and the fusion data refers to determining an attribute of an entity associated with an entity according to the fusion data, wherein the entity refers to something which has distinguishability and exists independently and is the most basic element of the historical knowledge graph, and the entity is represented as a vertex in a semantic network in the historical knowledge graph; the attribute refers to information describing the property of things or the property of the relation among things, and the information is represented as key value pair of an entity in the historical knowledge graph, wherein the key value pair consists of an attribute name and an attribute value.
In detail, the generating the historical knowledge graph of the historical attack data according to the initial node and the child node refers to determining the entity, attribute, relationship and other elements of the historical attack data according to the initial node and the child node, and generating the historical knowledge graph of the historical attack data by using the entity, attribute, relationship and other elements, wherein the relationship refers to ubiquitous links among things, and is a semantic edge describing the links among the entities in the historical knowledge graph.
S3, acquiring real-time attack events of the intelligent cloud, and generating event attack numbers of the real-time attack events according to a preset attack number algorithm.
In the embodiment of the present invention, the generating the event attack number of the real-time attack event according to the preset attack number algorithm includes:
extracting features of the real-time attack event to obtain event features of the real-time attack event;
Performing feature clustering on the event features by using a preset attack number algorithm to obtain clustered features of the event features;
and generating the event attack number of the implementation attack event according to the cluster characteristics.
In detail, the feature extraction of the real-time attack event may firstly perform format conversion on the real-time attack event, then perform data word segmentation on the data after format conversion, and perform data selection on the data after word segmentation, so as to obtain an event feature of the real-time attack event.
In detail, the preset attack number algorithm is as follows:
Wherein J (U, V) is the sum of squares of distances from the event features of the real-time attack event to the cluster center in each category, min (x) is a minimum function, n is the total number of features of the event features of the real-time attack event, c is a specified classification number of the event features, U ik is a matrix element m of an ith row and a kth column in a fuzzy classification matrix generated by the time features is a degree coefficient, x k is the kth event feature, V i is the ith cluster center, i is a feature identifier of the event feature, k is a category identifier of the cluster center, U is a fuzzy classification matrix generated by the time features, and V is a set of the cluster centers.
In detail, a minimum value of a sum of squares of distances from the event features of the real-time attack event to the clustering center under constraint conditions is determined according to the preset attack number algorithm, and feature clustering of the event features is performed according to the minimum value, wherein the minimum value represents similarity between the event features and the clustering center.
In detail, the generating the number of the attack events of the attack implementation event according to the cluster features refers to determining the number of the event features under a certain cluster center according to the cluster features, and determining the number of the event features under the certain cluster center as the number of the attack events of the attack implementation event generation type.
S4, generating an attack path of the real-time attack event, and carrying out spectrum updating on the historical knowledge spectrum according to the attack path and the event attack number to obtain an updated knowledge spectrum of the historical knowledge spectrum.
In an embodiment of the present invention, the generating the attack path of the real-time attack event includes:
extracting paths of the real-time attack events to obtain event paths of the real-time attack events;
and effectively identifying the event path to obtain an attack path of the event path.
In detail, the path extraction of the real-time attack event may determine an event log of the implementation attack event according to a page plug-in, perform word segmentation processing on the event log to obtain a log word segmentation of the event log, and perform word segmentation selection on the log word segmentation to obtain an event path of the real-time attack event.
In detail, the effective identification of the event path refers to that for the same event, the event paths of the events are different, and then the security of the event is different, for example, when the login event is sent from a common address, it may be initially determined that the login event is normal, and when the login event occurs in a different place, it is required to further determine whether the login event is normal, that is, the effective identification is an abnormal judgment.
In the embodiment of the present invention, the performing, according to the attack path and the number of attacks of the event, a graph update on the historical knowledge graph to obtain an updated knowledge graph of the historical knowledge graph includes:
Obtaining path weight of the attack path, and generating a real-time attack weight of the real-time attack event by using a preset attack weight algorithm, the path weight and the event attack number, wherein the preset attack weight algorithm is as follows:
Wherein, P is a real-time attack weight of the real-time attack event, w j is the jth path weight, delta j is the number of the event attacks corresponding to the jth path weight, j is the identification of the number of the event attacks, and T is the total number of the event attacks;
and carrying out spectrum updating on the historical knowledge spectrum by utilizing the real-time attack weight to obtain an updated knowledge spectrum of the historical knowledge spectrum.
In detail, the path weight of the attack path is determined according to the path risk degree of the attack path; the performing the map updating on the historical knowledge map by using the real-time attack weight refers to updating the attribute of the entity, the attribute value of the entity and the connection relationship of the attribute in the historical knowledge map according to the real-time attack weight.
S5, generating an intrusion attack sequence of the intelligent cloud according to the updated knowledge graph, and carrying out data attack processing on the intelligent cloud by using the intrusion attack sequence.
In the embodiment of the invention, the generation of the intrusion attack sequence of the smart cloud according to the updated knowledge graph is because the intrusion attack attribute of the smart cloud and the attribute value of the intrusion attack attribute are displayed on the updated knowledge graph, and the intrusion attack sequence is arranged according to the intrusion attack attribute and the attribute value of the intrusion attack attribute.
In the embodiment of the present invention, the data attack processing on the smart cloud by using the intrusion attack sequence refers to determining an attack to be processed according to an attribute value of an intrusion attack attribute in the intrusion attack sequence and a preset attack threshold, that is, when the attribute value is greater than the preset attack threshold, determining a corresponding intrusion attack attribute according to the attribute value, and performing corresponding data attack processing on the smart cloud according to the intrusion attack attribute.
According to the embodiment of the invention, knowledge extraction is carried out on historical attack data of the intelligent cloud to obtain knowledge data of the historical attack data, the knowledge extraction is carried out for generating data characteristics of the historical attack data, and the data fusion is carried out on the knowledge data to generate the historical knowledge map of the historical attack data of the intelligent cloud according to fusion data generated by data fusion, wherein the historical knowledge map simply and clearly shows the attribute and the attribute value of the historical attack data, the historical knowledge map is subjected to map updating by utilizing a real-time attack event, the knowledge map of the intelligent cloud is ensured to have instantaneity, the intelligent cloud can be more accurately described by the updated knowledge map through a data feedback form, and data attack processing is carried out on the intelligent cloud according to the updated knowledge map.
Fig. 4 is a functional block diagram of a data attack processing system applied to a smart cloud according to an embodiment of the present invention.
The data attack processing system 100 applied to the smart cloud can be installed in an electronic device. The data attack processing system 100 applied to the smart cloud may include a knowledge extraction module 101, a data fusion module 102, an attack number generation module 103, a map update module 104, and an attack processing module 105 according to the implemented functions. The module of the invention, which may also be referred to as a unit, refers to a series of computer program segments, which are stored in the memory of the electronic device, capable of being executed by the processor of the electronic device and of performing a fixed function.
In the present embodiment, the functions concerning the respective modules/units are as follows:
The knowledge extraction module 101 is configured to obtain historical attack data of a smart cloud, and perform knowledge extraction on the historical attack data according to a data type of the historical attack data to obtain knowledge data of the historical attack data;
the data fusion module 102 is configured to perform data fusion on the knowledge data to obtain fused data of the knowledge data, and generate a historical knowledge graph of the historical attack data according to the fused data;
The attack number generation module 103 is configured to obtain a real-time attack event of the smart cloud, and generate an event attack number of the real-time attack event according to a preset attack number algorithm, where the preset attack number algorithm is:
Wherein J (U, V) is the sum of squares of distances from the event features of the real-time attack event to the cluster center in each category, min (x) is a minimum function, n is the total number of features of the event features of the real-time attack event, c is a specified classification number of the event features, U ik is a matrix element m of an ith row and a kth column in a fuzzy classification matrix generated by the time features is a degree coefficient, x k is the kth event feature, V i is the ith cluster center, i is a feature identifier of the event feature, k is a category identifier of the cluster center, U is a fuzzy classification matrix generated by the time features, and V is a set of the cluster centers;
The spectrum updating module 104 is configured to generate an attack path of the real-time attack event, and update the historical knowledge spectrum according to the attack path and the attack number of the event to obtain an updated knowledge spectrum of the historical knowledge spectrum;
The attack processing module 105 is configured to generate an intrusion attack sequence of the smart cloud according to the updated knowledge graph, and perform data attack processing on the smart cloud by using the intrusion attack sequence.
In the several embodiments provided in the present invention, it should be understood that the disclosed methods and systems may be implemented in other ways. For example, the system embodiments described above are merely illustrative, e.g., the division of the modules is merely a logical function division, and other manners of division may be implemented in practice.
The modules described as separate components may or may not be physically separate, and components shown as modules may or may not be physical units, may be located in one place, or may be distributed over multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
In addition, each functional module in the embodiments of the present invention may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit. The integrated units can be realized in a form of hardware or a form of hardware and a form of software functional modules.
It will be evident to those skilled in the art that the invention is not limited to the details of the foregoing illustrative embodiments, and that the present invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof.
The present embodiments are, therefore, to be considered in all respects as illustrative and not restrictive, the scope of the invention being indicated by the appended claims rather than by the foregoing description, and all changes which come within the meaning and range of equivalency of the claims are therefore intended to be embraced therein. Any reference signs in the claims shall not be construed as limiting the claim concerned.
The blockchain is a novel application mode of computer technologies such as distributed data storage, point-to-point transmission, consensus mechanism, encryption algorithm and the like. The blockchain (Blockchain), essentially a de-centralized database, is a string of data blocks that are generated in association using cryptographic methods, each of which contains information from a batch of network transactions for verifying the validity (anti-counterfeit) of its information and generating the next block. The blockchain may include a blockchain underlying platform, a platform product services layer, an application services layer, and the like.
The embodiment of the application can acquire and process the related data based on the artificial intelligence technology. Wherein artificial intelligence (ARTIFICIAL INTELLIGENCE, AI) is the theory, method, technique, and application system that uses a digital computer or a digital computer-controlled machine to simulate, extend, and expand human intelligence, sense the environment, acquire knowledge, and use knowledge to obtain optimal results.
Furthermore, it is evident that the word "comprising" does not exclude other elements or steps, and that the singular does not exclude a plurality. Multiple units or systems as set forth in the system claims may also be implemented by means of one unit or system in software or hardware. The terms first, second, etc. are used to denote a name, but not any particular order.
Finally, it should be noted that the above-mentioned embodiments are merely for illustrating the technical solution of the present invention and not for limiting the same, and although the present invention has been described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that modifications and equivalents may be made to the technical solution of the present invention without departing from the spirit and scope of the technical solution of the present invention.

Claims (10)

1. A data attack processing method applied to a smart cloud, the method comprising:
Acquiring historical attack data of the intelligent cloud, and carrying out knowledge extraction on the historical attack data according to the data type of the historical attack data to obtain knowledge data of the historical attack data;
carrying out data fusion on the knowledge data to obtain fusion data of the knowledge data, and generating a historical knowledge graph of the historical attack data according to the fusion data;
Acquiring a real-time attack event of the intelligent cloud, and generating an event attack number of the real-time attack event according to a preset attack number algorithm, wherein the preset attack number algorithm is as follows:
wherein J (U, V) is the sum of squares of distances from the event features of the real-time attack event to the cluster centers in each class, min (x) is a minimum function, n is the total number of features of the event features of the real-time attack event, c is a specified classification number of the event features, U ik is a matrix element of an ith row and a kth column in a fuzzy classification matrix generated by the time features, m is a degree coefficient, x k is the kth event feature, V i is the ith cluster center, i is a feature identifier of the event feature, k is a class identifier of the cluster center, U is a fuzzy classification matrix generated by the time features, and V is a set of the cluster centers;
Generating an attack path of the real-time attack event, and carrying out spectrum updating on the historical knowledge spectrum according to the attack path and the event attack number to obtain an updated knowledge spectrum of the historical knowledge spectrum;
Generating an intrusion attack sequence of the intelligent cloud according to the updated knowledge graph, and carrying out data attack processing on the intelligent cloud by utilizing the intrusion attack sequence, wherein the intrusion attack sequence of the intelligent cloud is generated according to the updated knowledge graph because the updated knowledge graph comprises intrusion attack attributes of the intelligent cloud and attribute values of the intrusion attack attributes, and the intrusion attack sequence is arranged according to the intrusion attack attributes and the attribute values of the intrusion attack attributes; the data attack processing of the intelligent cloud by utilizing the intrusion attack sequence comprises the following steps: and determining the attack to be processed according to the attribute value of the intrusion attack attribute in the intrusion attack sequence and a preset attack threshold, namely determining the corresponding intrusion attack attribute according to the attribute value when the attribute value is larger than the preset attack threshold so as to accurately cope with the data attack.
2. The data attack processing method applied to the smart cloud as claimed in claim 1, wherein the performing knowledge extraction on the historical attack data according to the data type of the historical attack data to obtain knowledge data of the historical attack data includes:
Determining a data format of the historical attack data according to a data source of the historical attack data, and determining a data type of the historical attack data according to the data format, wherein the data type is structured data and unstructured data;
Performing triplet conversion on the structured data to obtain triplet data of the structured data;
and extracting information from the unstructured data to obtain information data of the unstructured data, and collecting the triplet data and the information data as knowledge data of the historical attack data.
3. The data attack processing method applied to the smart cloud as claimed in claim 2, wherein the performing the triplet conversion on the structured data to obtain the triplet data of the structured data includes:
performing data mapping on the structured data to obtain mapping data of the structured data;
performing data selection on the mapping data according to a preset ternary label to obtain target data of the mapping data;
and determining the corresponding relation of the target data, and generating the triple data of the structured data according to the corresponding relation and the target data.
4. The data attack processing method applied to the smart cloud as claimed in claim 2, wherein the extracting information of the unstructured data to obtain information data of the unstructured data includes:
performing word segmentation processing on the unstructured data to obtain data word segmentation of the unstructured data;
Performing body extraction on the unstructured data according to the data word segmentation to obtain body data of the unstructured data;
Performing entity extraction on the unstructured data according to the data word segmentation to obtain entity data of the unstructured data;
And generating information data of the unstructured data according to the body data and the entity data.
5. The data attack processing method applied to the smart cloud as claimed in claim 1, wherein the data fusion is performed on the knowledge data to obtain the fused data of the knowledge data, and the method comprises the following steps:
carrying out semantic extraction on the knowledge data to obtain knowledge semantics of the knowledge data;
Performing entity association on entity data of the knowledge data according to the knowledge semantics to obtain associated data of the entity data;
and carrying out data fusion on the knowledge data according to the associated data to obtain fusion data of the knowledge data.
6. The data attack processing method applied to the smart cloud as claimed in claim 1, wherein the generating the historical knowledge-graph of the historical attack data according to the fusion data comprises:
generating initial nodes of the historical attack data according to the ontology data in the fusion data;
Determining a node label of the initial node, and performing branch configuration on the initial node according to the node label and the fusion data to obtain a child node of the initial node;
And generating a historical knowledge graph of the historical attack data according to the initial node and the child node.
7. The data attack processing method applied to the smart cloud as claimed in claim 1, wherein the generating the event attack number of the real-time attack event according to a preset attack number algorithm includes:
extracting features of the real-time attack event to obtain event features of the real-time attack event;
Performing feature clustering on the event features by using a preset attack number algorithm to obtain clustered features of the event features;
and generating the event attack number of the implementation attack event according to the cluster characteristics.
8. The data attack processing method applied to the smart cloud as claimed in claim 1, wherein the generating the attack path of the real-time attack event comprises:
extracting paths of the real-time attack events to obtain event paths of the real-time attack events;
and effectively identifying the event path to obtain an attack path of the event path.
9. The data attack processing method applied to the smart cloud according to any one of claims 1 to 8, wherein the performing the map update on the historical knowledge map according to the attack path and the number of the event attacks to obtain an updated knowledge map of the historical knowledge map includes:
Obtaining path weight of the attack path, and generating a real-time attack weight of the real-time attack event by using a preset attack weight algorithm, the path weight and the event attack number, wherein the preset attack weight algorithm is as follows:
Wherein, P is a real-time attack weight of the real-time attack event, w j is the jth path weight, delta j is the number of the event attacks corresponding to the jth path weight, j is the identification of the number of the event attacks, and T is the total number of the event attacks;
and carrying out spectrum updating on the historical knowledge spectrum by utilizing the real-time attack weight to obtain an updated knowledge spectrum of the historical knowledge spectrum.
10. A data attack handling system for a smart cloud for performing the data attack handling method for a smart cloud according to any of claims 1-9, the system comprising:
The knowledge extraction module is used for acquiring historical attack data of the intelligent cloud, and carrying out knowledge extraction on the historical attack data according to the data type of the historical attack data to obtain knowledge data of the historical attack data;
The data fusion module is used for carrying out data fusion on the knowledge data to obtain fusion data of the knowledge data, and generating a historical knowledge graph of the historical attack data according to the fusion data;
The attack number generation module is used for acquiring the real-time attack event of the intelligent cloud and generating the event attack number of the real-time attack event according to a preset attack number algorithm, wherein the preset attack number algorithm is as follows:
wherein J (U, V) is the sum of squares of distances from the event features of the real-time attack event to the cluster centers in each class, min (x) is a minimum function, n is the total number of features of the event features of the real-time attack event, c is a specified classification number of the event features, U ik is a matrix element of an ith row and a kth column in a fuzzy classification matrix generated by the time features, m is a degree coefficient, x k is the kth event feature, V i is the ith cluster center, i is a feature identifier of the event feature, k is a class identifier of the cluster center, U is a fuzzy classification matrix generated by the time features, and V is a set of the cluster centers;
the pattern updating module is used for generating an attack path of the real-time attack event, and carrying out pattern updating on the historical knowledge pattern according to the attack path and the event attack number to obtain an updated knowledge pattern of the historical knowledge pattern;
The attack processing module is used for generating an intrusion attack sequence of the intelligent cloud according to the updated knowledge graph, and carrying out data attack processing on the intelligent cloud by utilizing the intrusion attack sequence, wherein the intrusion attack sequence of the intelligent cloud is generated according to the updated knowledge graph because the updated knowledge graph comprises intrusion attack attributes of the intelligent cloud and attribute values of the intrusion attack attributes, and the intrusion attack sequence is arranged according to the intrusion attack attributes and the attribute values of the intrusion attack attributes; the data attack processing of the intelligent cloud by utilizing the intrusion attack sequence comprises the following steps: and determining the attack to be processed according to the attribute value of the intrusion attack attribute in the intrusion attack sequence and a preset attack threshold, namely determining the corresponding intrusion attack attribute according to the attribute value when the attribute value is larger than the preset attack threshold so as to accurately cope with the data attack.
CN202310703547.7A 2023-06-14 2023-06-14 Data attack processing method and system applied to intelligent cloud Active CN116796310B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202310703547.7A CN116796310B (en) 2023-06-14 2023-06-14 Data attack processing method and system applied to intelligent cloud

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202310703547.7A CN116796310B (en) 2023-06-14 2023-06-14 Data attack processing method and system applied to intelligent cloud

Publications (2)

Publication Number Publication Date
CN116796310A CN116796310A (en) 2023-09-22
CN116796310B true CN116796310B (en) 2024-10-18

Family

ID=88047441

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202310703547.7A Active CN116796310B (en) 2023-06-14 2023-06-14 Data attack processing method and system applied to intelligent cloud

Country Status (1)

Country Link
CN (1) CN116796310B (en)

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111988339A (en) * 2020-09-07 2020-11-24 珠海市一知安全科技有限公司 Network attack path discovery, extraction and association method based on DIKW model
CN114218568A (en) * 2021-12-10 2022-03-22 萍乡市圣迈互联网科技有限公司 Big data attack processing method and system applied to cloud service

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11283825B2 (en) * 2018-12-03 2022-03-22 Accenture Global Solutions Limited Leveraging attack graphs of agile security platform
CN115296924B (en) * 2022-09-22 2023-01-31 中国电子科技集团公司第三十研究所 Network attack prediction method and device based on knowledge graph
CN115955355A (en) * 2022-12-30 2023-04-11 绿盟科技集团股份有限公司 Method and device for outputting attack event knowledge graph

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111988339A (en) * 2020-09-07 2020-11-24 珠海市一知安全科技有限公司 Network attack path discovery, extraction and association method based on DIKW model
CN114218568A (en) * 2021-12-10 2022-03-22 萍乡市圣迈互联网科技有限公司 Big data attack processing method and system applied to cloud service

Also Published As

Publication number Publication date
CN116796310A (en) 2023-09-22

Similar Documents

Publication Publication Date Title
Alam et al. Processing social media images by combining human and machine computing during crises
WO2021174944A1 (en) Message push method based on target activity, and related device
WO2022174491A1 (en) Artificial intelligence-based method and apparatus for medical record quality control, computer device, and storage medium
US20180293505A1 (en) Method for clustering nodes of a textual network taking into account textual content, computer-readable storage device and system implementing said method
CN111612041B (en) Abnormal user identification method and device, storage medium and electronic equipment
US11042581B2 (en) Unstructured data clustering of information technology service delivery actions
CN106844407B (en) Tag network generation method and system based on data set correlation
US20120095955A1 (en) Facilitating relationships and information transactions
CN115002200B (en) Message pushing method, device, equipment and storage medium based on user portrait
CN114398557B (en) Information recommendation method and device based on double images, electronic equipment and storage medium
CN113946690A (en) Potential customer mining method and device, electronic equipment and storage medium
US20220414491A1 (en) Automated resolution of over and under-specification in a knowledge graph
US20220050825A1 (en) Block chain based management of auto regressive database relationships
CN113297139B (en) Metadata query method and system and electronic equipment
CN116796310B (en) Data attack processing method and system applied to intelligent cloud
CN114049089A (en) Method and system for constructing government affair big data platform
JP2023534239A (en) Improved entity resolution for master data with qualified relationship scores
CN113298645B (en) Resource quota adjustment method and device and electronic equipment
US10885157B2 (en) Determining a database signature
CN116737947A (en) Entity relationship diagram construction method, device, equipment and storage medium
CN115935958A (en) Resume processing method and device, storage medium and electronic equipment
CN112685574B (en) Method and device for determining hierarchical relationship of domain terms
CN115114519A (en) Artificial intelligence based recommendation method and device, electronic equipment and storage medium
CN114090850A (en) Log classification method, electronic device and computer-readable storage medium
CN114860821A (en) Data importing method and device of graph database, storage medium and electronic equipment

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
TA01 Transfer of patent application right

Effective date of registration: 20240923

Address after: Room 316, Building 16, 388 Yindu Road, Xuhui District, Shanghai 200030

Applicant after: Shanghai Ruiji Computer Technology Co.,Ltd.

Country or region after: China

Address before: Room 1503, Building 13, Lijia Center, Qingchang Avenue, Yinxi Street, Fuqing City, Fuzhou City, Fujian Province, 350000

Applicant before: Fuzhou Superman Network Technology Co.,Ltd.

Country or region before: China

TA01 Transfer of patent application right
GR01 Patent grant
GR01 Patent grant