Abstract: The disclosure relates to the technical field of cloud resource pools, and in particular to a cloud security source pool system based on distributed architecture. The system includes: a central control unit, configured for building a cloud resource pool according to security device parameters, where the cloud resource pool includes multiple virtual security machines; and a security monitoring unit, configured for setting multiple request categories according to network structure parameters. The security monitoring unit is further configured for constructing a security sub-model of each of the request categories. Based on the distributed architecture and virtualization technology, each security device is built as a virtual security machine, and a cloud resource pool is built according to all virtual security machines, so as to realize the dynamic call of all security resources, and at the same time, multiple request categories are built based on historical parameters.

Abstract: A network mapping behavior anomaly detection method and system based on machine learning is provided. The method includes: collecting dual-source traffic data, generating a structured log data set through dual-source log fusion engine; performing subgraph matching calculation to obtain a mapping behavior deviation degree; generating communication data containing a watermark identifier in a session corresponding communication path; verifying whether attack events carry the watermark identifier; generating a network mapping behavior anomaly detection report.

Abstract: Provided are harmless attack verification and analysis method and system. The method includes: acquiring multi-source security data, determining attack cases in the data to construct an attack knowledge graph; constructing a scenario-based attack flow chart based on the graph, and formulating a harmless attack task based on the chart; determining a number of paths and a number of nodes of attack paths in the harmless attack task, and decomposing the harmless attack task into sub-tasks based on the number of paths and the number of nodes; acquiring path information of each attack path, determining a complexity of the attack path based on the path information, and determining attack priorities of the sub-tasks based on the complexities of the attack paths; and determining an attack sequence of the sub-tasks based on the attack priorities, and performing simulated attack verification on a protection boundary by the sub-tasks in the attack sequence.