Priority asynchronous processing method and system for network security

Abstract

According to the priority asynchronous processing method and system for network security, multiple data sources are integrated, the threat level of each data packet is evaluated in real time, and the processing priority of each data packet is dynamically adjusted according to the threat level. Different from a traditional static method, the method provided by the invention utilizes an advanced machine learning algorithm, can perform dynamic evaluation in multiple dimensions, and timely identifies and preferentially processes high-risk data packets. The mechanism obviously improves the response capability of the system to novel and complex attacks. Meanwhile, a multi-node cooperative attack response mechanism is introduced, when a certain node detects abnormal traffic, other nodes can be automatically notified, threat situation information can be shared, and therefore rapid cooperative reaction is achieved. The integrated innovation not only enhances the overall security of the network, but also optimizes the data packet processing efficiency, effectively solves the main defects in the traditional network security system, and provides a new thought for constructing a safer and more flexible network environment.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a priority asynchronous processing method and system for network security. Background Art

[0002] With the rapid development of information technology, network security issues have become increasingly prominent and have become a major challenge faced by various organizations and enterprises. Existing network security protection systems usually rely on static rules and signature recognition methods, which are extremely vulnerable to new attacks. For example, traditional intrusion detection systems (IDS) and firewalls can only detect known threats, and their response capabilities are extremely insufficient for zero-day attacks or complex hybrid attacks. In addition, the existing systems have obvious lags in traffic processing and priority management, and cannot adapt to the dynamic changes of the network environment in real time. When many network devices encounter high traffic or sudden attacks, it is difficult to effectively distinguish between critical data packets and low-priority data packets, resulting in delays in important data processing and affecting the overall security and availability of the system. In addition, various factors in the network environment (such as user behavior, traffic patterns, etc.) are often ignored, and the impact of these factors on threat assessment is not fully considered, resulting in reduced pertinence and effectiveness of defense measures. These shortcomings make it difficult for existing network security solutions to meet the rapidly changing network environment and diverse forms of attacks. Summary of the invention

[0003] The purpose of the present invention is to design a priority asynchronous processing method and system for network security, which integrates multiple data sources (such as intrusion detection systems, user behavior analysis and network traffic monitoring) to evaluate the threat level of each data packet in real time and dynamically adjust its processing priority accordingly.

[0004] In order to achieve the above object, a first aspect of the present invention provides a priority asynchronous processing method for network security, the method comprising:

[0005] S1. Collect real-time data by using a stream processing framework, preprocess the real-time data, and output the preprocessed data, where the preprocessed data is a data set, and the data set includes selected features and a label for each feature;

[0006] S2. The selected features are combined into a feature data set and a corresponding label data set. A weighted scoring algorithm is designed for the feature data set and the corresponding label data set. The weight of each feature is calculated by analyzing the mutual information of the features and the historical attack detection rate. The weighted feature set of each feature is obtained according to the weight of each feature. Then, a threat classification model is constructed to calculate the threat score of each feature. The threat level of each feature is obtained by comparing the threat score of each feature with the dynamic threshold.

[0007] S3. Assign priority weights to each data packet based on the threat level of each feature combined with the current network load status, historical processing records, and current security risks. Then adjust the priority weight of each data packet based on the weighted feature set of each feature and the real-time network status. Finally, arrange the data packets from high to low priority to generate the final priority processing queue to ensure that high-priority threats are processed first.

[0008] Wherein, the S3 specifically includes:

[0009] S301. Introduce impact factor ξ according to the threat level of each feature i , assign a priority weight P to each packet L , ensuring that the highest threat data packets receive the highest processing priority;

[0010] S302: Allocate priority weight P to each data packet L Combine the weight of each feature to calculate the priority value V i , combining the preliminary priority value with the dynamic environment of the network, designing an adjustment mechanism based on the real-time network status, ensuring that the processing order is dynamically adjusted under high load, and outputting the dynamic priority value V′ adjusted by the adjustment mechanism based on the real-time network status i ;

[0011] S303, based on the calculated dynamic priority value V′ i , sort the data packets from high to low according to the priority value, and generate the final priority processing queue Q final ; Wherein, the priority processing queue Q final Includes the dynamic priority value V' of each data packet i , the weight of the feature f w and corresponding threat levels;

[0012] S4. Implement the coordinated response mechanism, specifically:

[0013] Monitor the status information of each node in the network, which includes the current processing capacity, load and response delay. When a node detects a high-threat data packet, the current node generates a threat notification packet and broadcasts the threat information to other nodes. When other nodes receive the threat notification packet from the current node, they will dynamically adjust the priority of their processing queue based on their own status and the received threat information. After completing the priority adjustment, other nodes update their priority processing queue Q j , and rearrange the task processing order based on the new priority value, and generate a feedback information packet after other nodes complete the threat response, and feed it back to the central controller and other related nodes; wherein the high threat data packet is a dynamic priority value V′i Exceeding a preset threshold value θ;

[0014] S5. After the coordinated response is triggered, each node needs to execute its priority queue Q j High-threat packets in the V j After completing the task processing, each node generates feedback information and feeds it back to the central controller and other collaborative nodes. The central controller adjusts the future priority allocation, resource scheduling and node collaboration strategy based on the feedback information provided by each node and the historical processing results.

[0015] S6. Perform adaptive learning based on the feedback information and historical feedback information.

[0016] Furthermore, the real-time data includes: network traffic and potential attack behaviors in the network traffic, user behavior patterns and abnormal behaviors in the user behavior patterns, and real-time network data packets;

[0017] The preprocessing includes: data cleaning and standardization processing, using mutual information measurement to evaluate the correlation between each feature and the label after standardization processing, the label is normal traffic or attack traffic, selecting the top k features with higher correlation, and then performing PCA dimensionality reduction processing on the selected features, and finally outputting the preprocessed data.

[0018] Furthermore, the weighted scoring algorithm is expressed as follows:

[0019] W i =α·I(F i ,Y)+β·T i +γ·R i

[0020] Among them, I(F i ,Y) is the feature F i The mutual information with label Y reflects the contribution of the feature to attack identification; T i For feature F i Attack detection rate in historical data; R i is a regular term, indicating the feature F i The stability in the most recent time window is calculated as the inverse of the feature change rate; α, β, γ are weight coefficients to ensure the balance between stability and contribution;

[0021] The threat classification model is constructed as follows:

[0022] Decision tree, random forest and support vector machine are selected as basic classifiers to output the threat score S of each sample. The calculation formula is:

[0023]

[0024] Among them, C m (F w ) represents the weighted feature set F of the mth basic classifier w The classification result, M is the number of basic classifiers;

[0025] Add a regular term R to the threat classification model S , which is used to adjust the model's sensitivity to abnormal samples. The calculation formula for the modified score S′ is:

[0026] S′=S-λ·R S

[0027] Among them, λ is a hyperparameter, R S is the ratio of anomaly classifications in historical data by the model.

[0028] Furthermore, after calculating the threat score of each feature, a dynamic threshold calculation mechanism based on the ROC curve is used, which is expressed as follows:

[0029] θ=median(S′)+k·std(S′)+δ

[0030] Among them, δ is a specific adjustment factor, which depends on the change of attack mode in the recent period of time. By comparing the current threat score S′ with the dynamic threshold θ, the threat level L of each sample is obtained, which is defined as:

[0031]

[0032] Furthermore, according to the threat level of each feature, an impact factor ξ is introduced. i , assign a priority weight P to each packet L , the specific allocation is as follows:

[0033]

[0034] Among them, P low ,P medium ,P high is the preset basic priority value; i is the impact factor, defined as:

[0035]

[0036] Among them, λ is the adjustment coefficient of the historical processing load, η(t) represents the current system network load, ensuring that the system can adjust the priority more sensitively when the load is high;

[0037] According to each data packet, a priority weight P is assigned L Combine the weight of each feature to calculate the priority value Vi , set up as follows:

[0038]

[0039] Among them, W j The feature f w The weight of (j); f w (j) is the value of the jth weighted feature; φ is a regularization term, which is expressed as a confidence adjustment term for high-weight features; Z is a normalization constant used to normalize the priority value V i Adjust to a reasonable scale;

[0040] The preliminary priority value is combined with the dynamic environment of the network, and an adjustment mechanism based on the real-time network status is designed to ensure that the processing order is dynamically adjusted when the load is high, and the dynamic priority value V′ adjusted by the adjustment mechanism based on the real-time network status is output. i , which is expressed as follows:

[0041] V′ i =V i +Δ(t)·θ(t)

[0042] Among them, Δ(t) is the real-time adjustment coefficient, which is calculated based on the current network load, network security situation and data packet arrival; θ(t) is the security adjustment coefficient that is dynamically updated according to traffic and threat type;

[0043] The changing trend of the real-time changing adjustment coefficient Δ(t) is that when the load increases, the Δ(t) value increases, and the data packets with high priority are processed first.

[0044] Furthermore, the threat notification packet T i Contains the key features, priority, source, current node status and threat confidence of the current node; the threat confidence of the current node λ i Indicates the urgency of the threat, and the calculation formula is:

[0045]

[0046] Among them, R i (t) is the response time of the node;

[0047] When other nodes receive a threat notification packet from a node, the node will dynamically adjust the priority of its processing queue based on its own state and the received threat information, as shown below:

[0048] According to the load, capability and received threat confidence λ of node j i Adjust to the new priority value V j ″, calculated as follows:

[0049]

[0050] Among them, V′ i The dynamic priority value reported for node i; is the current load factor of node j, which is used to balance the processing capacity of nodes and prevent high-load nodes from receiving more high-priority tasks; i is the threat confidence of node i.

[0051] Further, according to the completion of the new priority value V j After the priority is adjusted, a dynamic resource allocation algorithm is introduced for the node:

[0052] The node dynamically adjusts the available resources R according to the threat level and current load j (t), the calculation formula is:

[0053]

[0054] in, is the maximum available resource of node j; α is the adjustment parameter used to control the allocation rate of response resources; V j ″ is the adjusted priority, θ is the threshold of resource allocation.

[0055] Furthermore, the S5 specifically includes:

[0056] S501, in the coordinated response trigger, the current node needs to be based on the current load state S j (t) Dynamically allocate resources, each node based on its processing capacity C j (t) and load condition L j (t), for data packet P i Perform resource allocation and introduce dynamic adjustment factor ρ j (t) Adjust available resources according to load changes;

[0057] S502, after completing task processing, each node generates feedback information and adds an execution quality score to quantify the node task processing efficiency, which is expressed as follows:

[0058]

[0059] Among them, μ j (t) is the execution quality score, V j ″(i) is the final priority value of the current task, R j (t) is the resource consumption during task execution, D j (t) is the delay in task processing;

[0060] S503, based on the obtained execution quality score μ j (t), the central controller adjusts the priority setting of the next task, as shown below:

[0061]

[0062] Among them, β is the optimization step coefficient, which controls the amplitude of priority adjustment; λ j (t) is the urgency processing result of the task, reflecting whether the task is successfully processed; θ' is the priority adjustment threshold, and the priority is adjusted according to this threshold;

[0063] At the same time, the resource consumption of each task is used to optimize the future resource allocation strategy, and the resource consumption R in the feedback information is used to optimize the future resource allocation strategy. j (t), adjust the resource allocation of future tasks, expressed as follows:

[0064]

[0065] Among them, γ is the resource optimization step coefficient; R j (t) is the resource consumption during task processing; V j ″(i) is the priority value of the task, reflecting its importance; ζ is the expected resource consumption ratio, ensuring that resource utilization remains in a reasonable range.

[0066] Furthermore, the S6 specifically includes:

[0067] S601, summarizing the feedback data received by all nodes and designing a feedback matrix M to store it;

[0068] S602, optimizing the priority of tasks through historical data and resource utilization, and updating future task strategies using an adaptive adjustment mechanism;

[0069] S603, using incremental learning to update the feedback matrix M;

[0070] S604: Introduce a feature optimization mechanism to dynamically identify new threat patterns and adapt, as shown below:

[0071]

[0072] Where, ΔW f represents the feature weight update amount; λ f represents the feature learning rate; L f represents the processing failure rate of this feature in historical tasks; T f Indicates the total number of times the feature is processed; ∈ indicates a constant to prevent division by zero.

[0073] In a second aspect of the present invention, a priority asynchronous processing system for network security is provided, the system comprising:

[0074] The network data collection module is used to collect real-time data by using a stream processing framework, preprocess the real-time data, and output the preprocessed data, wherein the preprocessed data is a data set, and the data set includes selected features and labels for each feature;

[0075] The feature weighting module is used to group the selected features into feature data sets and corresponding label data sets, design a weighted scoring algorithm for the feature data sets and the corresponding label data sets, calculate the weight of each feature by analyzing the mutual information and historical attack detection rate of the features, obtain the weighted feature set of each feature according to the weight of each feature, and then build a threat classification model to calculate the threat score of each feature, and obtain the threat level of each feature by comparing the threat score of each feature with the dynamic threshold;

[0076] The priority processing module is used to assign a priority weight to each data packet according to the threat level of each feature combined with the current network load status, historical processing records and current security risks, and then adjust the priority weight of each data according to the weighted feature set of each feature and the real-time network status. Finally, the data packets are arranged from high to low according to priority to generate the final priority processing queue to ensure that good threats with high priority are processed first;

[0077] The priority processing module specifically performs the following steps:

[0078] S301. Introduce impact factor ξ according to the threat level of each feature i , assign a priority weight P to each packet L , ensuring that the highest threat data packets receive the highest processing priority;

[0079] S302: Allocate priority weight P to each data packet L Combine the weight of each feature to calculate the priority value V i , combining the preliminary priority value with the dynamic environment of the network, designing an adjustment mechanism based on the real-time network status, ensuring that the processing order is dynamically adjusted under high load, and outputting the dynamic priority value V′ adjusted by the adjustment mechanism based on the real-time network status i ;

[0080] S303, based on the calculated dynamic priority value V′ i , sort the data packets from high to low according to the priority value, and generate the final priority processing queue Q final ; Wherein, the priority processing queue Q final Includes the dynamic priority value V' of each data packeti , the weight of the feature f w and corresponding threat levels;

[0081] The collaborative processing module is used to execute the collaborative response mechanism, specifically:

[0082] Monitor the status information of each node in the network, which includes the current processing capacity, load and response delay. When a node detects a high-threat data packet, the current node generates a threat notification packet and broadcasts the threat information to other nodes. When other nodes receive the threat notification packet from the current node, they will dynamically adjust the priority of their processing queue based on their own status and the received threat information. After completing the priority adjustment, other nodes update their priority processing queue Q j , and rearrange the task processing order based on the new priority value, and generate a feedback information packet after other nodes complete the threat response, and feed it back to the central controller and other related nodes; wherein the high threat data packet is a dynamic priority value V′ i Exceeding a preset threshold value θ;

[0083] The node processing module is used to execute the priority queue Q of each node after the coordinated response is triggered. j High-threat packets in the V j After completing the task processing, each node generates feedback information and feeds it back to the central controller and other collaborative nodes. The central controller adjusts the future priority allocation, resource scheduling and node collaboration strategy based on the feedback information provided by each node and the historical processing results.

[0084] The adaptive optimization module is used to perform adaptive optimization according to the feedback information combined with historical feedback information.

[0085] The beneficial technical effects of the present invention are at least as follows:

[0086] The present invention integrates multiple data sources (such as intrusion detection systems, user behavior analysis, and network traffic monitoring) to evaluate the threat level of each data packet in real time, and dynamically adjust its processing priority accordingly. Unlike traditional static methods, the present invention uses advanced machine learning algorithms to perform dynamic evaluations in multiple dimensions, timely identify high-risk data packets and give priority to them. This mechanism significantly improves the system's ability to respond to new and complex attacks. At the same time, the present invention also introduces a multi-node collaborative attack response mechanism. When a node detects abnormal traffic, it can automatically notify other nodes and share threat situation information, thereby achieving rapid collaborative response. This integrated innovation not only enhances the overall security of the network, but also optimizes the efficiency of data packet processing, effectively solves the main defects in traditional network security systems, and provides new ideas for building a more secure and flexible network environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0087] The present invention is further described using the accompanying drawings, but the embodiments in the accompanying drawings do not constitute any limitation to the present invention. A person skilled in the art can obtain other drawings based on the following drawings without creative work.

[0088] Figure 1 The present invention is a flow chart of a priority asynchronous processing method for network security.

[0089] Figure 2 This is a framework diagram of a priority asynchronous processing system for network security according to the present invention. DETAILED DESCRIPTION

[0090] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be understood as limiting the present invention.

[0091] In one or more embodiments, Figure 1 As shown, a priority asynchronous processing method for network security is disclosed, and the method includes the following steps S1-S6:

[0092] S1. Real-time data is collected by using a stream processing framework, and the real-time data is preprocessed to output the preprocessed data, where the preprocessed data is a data set, and the data set includes selected features and a label for each feature.

[0093] Specifically, identifying multiple key data sources is the first step to achieve comprehensive monitoring. Specific data sources include:

[0094] Intrusion Detection System (IDS): monitors network traffic and detects potential attacks.

[0095] User Behavior Analysis (UBA): Analyze user behavior patterns and identify abnormal activities.

[0096] Network traffic monitoring device: captures and analyzes network packets in real time.

[0097] By using a stream processing framework such as Apache Kafka or Apache NiFi, you can build an efficient real-time data collection pipeline. The output of data collection can be expressed as:

[0098]

[0099] Among them, D i represents the i-th data source, and n is the number of data sources. Each data source sends data to the data pipeline regularly to ensure the real-time and integrity of the data flow. For each data source, you need to define the corresponding collection strategy, such as the collection frequency and data format (JSON, CSV, etc.).

[0100] Furthermore, before the data enters the subsequent processing stage, it must be cleaned to eliminate irrelevant information and noise. The specific steps include:

[0101] Deduplication: Identify and delete duplicate data to prevent the same data from interfering with the analysis results.

[0102] Missing value processing: Use interpolation methods (such as linear interpolation or K nearest neighbor interpolation) to fill missing values ​​to ensure data integrity. For example, for feature X j The missing values ​​can be linearly interpolated using the following formula:

[0103]

[0104] Among them, X j ' is the interpolated value, and are the known values ​​before and after of the feature respectively.

[0105] Standardization: Z-score standardization is performed on the feature data to eliminate the dimensional differences between different features. The formula is:

[0106]

[0107] Among them, Z j is the standardized value, X j is the original value, μ j is the mean of feature j, σ jis the standard deviation of feature j. Through standardization, the data range of all features is compressed to a similar scale, ensuring that different features contribute equally to the model in subsequent analysis.

[0108] Furthermore, in order to improve the efficiency and accuracy of analysis, key features related to network security threats need to be extracted from the cleaned data. The steps of feature selection include:

[0109] Correlation evaluation: Use the mutual information metric (MutualInformation) to evaluate the correlation between each feature and the label (such as normal traffic or attack traffic). Select the top k features with high correlation. For example, calculate the mutual information using the following formula:

[0110]

[0111] Among them, P(x,y) is the joint probability distribution of feature X and label Y, and P(x) and P(y) are their respective marginal probability distributions.

[0112] Feature extraction: The selected features are further processed, such as using principal component analysis (PCA) to reduce the feature dimensions and retain the most important information. PCA can calculate the principal components through the following steps:

[0113] Z=XW

[0114] Among them, Z is the feature matrix after dimensionality reduction, X is the feature matrix after standardization, and W is the weight matrix containing the principal components.

[0115] Furthermore, the processed data is stored in a high-performance structured database (such as PostgreSQL or Elasticsearch) for quick query and access during subsequent analysis. The output format of the stored procedure is D clean , whose structure contains the selected feature set F and its corresponding label information, in the form of:

[0116] D clean ={(f1,y1),(f2,y2),…,(f k ,y k )}

[0117] Among them, f i represents the selected features, y i Label each sample (normal or abnormal). By ensuring that the data output format matches the input requirements of the subsequent steps (threat level assessment), it lays the foundation for the subsequent efficient processing of the system.

[0118] Through the above detailed steps, the data collection and preprocessing solution ensures high-quality input data for subsequent threat assessment. This solution not only solves the problems of data redundancy and low quality in the background technology, but also lays a solid foundation for the entire patent solution, enabling subsequent analysis to accurately and effectively identify and respond to network attacks.

[0119] S2. The selected features are combined into a feature data set and a corresponding label data set. A weighted scoring algorithm is designed for the feature data set and the corresponding label data set. The weight of each feature is calculated by analyzing the mutual information and historical attack detection rate of the features. The weighted feature set of each feature is obtained according to the weight of each feature. Then, a threat classification model is constructed to calculate the threat score of each feature. The threat level of each feature is obtained by comparing the threat score of each feature with the dynamic threshold.

[0120] Specifically, in order to improve the accuracy of threat assessment, it is necessary to first assign weights to features. The present invention designs a weighted scoring algorithm to calculate the weight W of each feature by analyzing the mutual information of the features and the historical attack detection rate. i The formula is as follows:

[0121] W i =α·I(F i ,Y)+β·T i +γ·R i

[0122] Among them, I(F i ,Y) is the feature F i The mutual information with label Y reflects the contribution of the feature to attack identification. i For feature F i Attack detection rate in historical data. R i is a regular term, indicating the feature F i The stability in the most recent time window is calculated as the inverse of the feature change rate. α, β, γ are weight coefficients, usually set to 0.4, 0.4, 0.2 to ensure a balance between stability and contribution.

[0123] Next, the weighted feature set F w The calculation method is as follows:

[0124]

[0125] Among them, F i is the i-th feature in the feature set F. i is the corresponding feature weight. n is the total number of features.

[0126] Furthermore, after obtaining the weighted feature set, an ensemble learning method is used to construct a threat classification model, combining multiple basic classifiers to improve detection capabilities. Decision trees, random forests, and support vector machines (SVMs) are selected as basic classifiers. The model output is the threat score S of each sample, calculated as follows:

[0127]

[0128] Among them, C m (F w ) represents the weighted feature set F of the mth basic classifier w The classification result is M, and M is the number of basic classifiers. In order to further improve the robustness of the model, the present invention introduces a regularization term R S , which is used to adjust the model's sensitivity to abnormal samples. The corrected score calculation formula is:

[0129] S'=S-λ·R S

[0130] Among them, λ is a hyperparameter, R S is the ratio of the model’s anomaly classification in historical data. The output of this step is the dynamic update S’ of the threat score, ensuring accuracy and flexibility.

[0131] Furthermore, the dynamically adjusted threshold mechanism helps to flexibly respond to threats based on real-time data and historical patterns. The present invention uses a dynamic threshold calculation mechanism based on the ROC curve, and the formula is:

[0132] θ=median(S')+k·std(S')+δ

[0133] Among them, δ is a specific adjustment factor, which depends on the change of attack mode in the recent period of time. For example, it can be adjusted based on the number of recent attack events. By comparing the current threat score S' with the dynamic threshold θ, the threat level L of each sample is obtained, which is defined as:

[0134]

[0135] This step provides a clear basis for subsequent prioritization, ensuring timely response to high threat levels.

[0136] Finally, the threat level L of each sample is combined with its corresponding weighted feature F w Stored together for subsequent priority processing. The output format is D threat , contains the following structure:

[0137] D threat ={(f w ,L)|f w ∈F w,L∈{low,medium,high}}

[0138] This structure ensures that subsequent steps can quickly adjust the priority of network traffic processing according to the threat level, improving overall network security.

[0139] Through this threat level assessment scheme, combined with feature importance weighting, integrated learning classification and dynamic threshold adjustment, the accuracy and response speed of threat identification are effectively improved. This scheme directly solves the problems of inaccurate threat identification and delayed response in the background technology, provides a solid foundation for subsequent priority processing, and ensures the security and stability of the network environment.

[0140] S3. Assign priority weights to each data packet based on the threat level of each feature combined with the current network load status, historical processing records, and current security risks. Then adjust the priority weight of each data packet based on the weighted feature set of each feature and the real-time network status. Finally, arrange the data packets from high to low priority to generate the final priority processing queue to ensure that good threats with high priority are processed first.

[0141] Specifically, first, the present invention assigns a priority weight P to each data packet. L , the weight is determined according to the threat level L to ensure that high-threat data packets can obtain higher processing priority. Different from the conventional priority allocation strategy, the present invention introduces an innovative impact factor ξ i , to capture the urgency of each packet processing. This influencing factor combines network load status, historical processing records and current security risks. Priority weight allocation formula:

[0142]

[0143] Among them, P low ,P medium ,P high is the preset basic priority value, such as P low =1,P medium =3,P high =5. i is the impact factor, defined as:

[0144]

[0145] Among them, λ is the adjustment coefficient of the historical processing load (such as 0.5), and η(t) represents the current system network load, ensuring that the system can adjust the priority more sensitively when the load is high. By introducing the impact factor, it is ensured that the system can still give priority to high-threat traffic during busy hours.

[0146] Furthermore, after calculating the priority weight of each data packet, it is necessary to combine it with the data packet feature F w To make more accurate priority adjustments, the present invention designs a new priority calculation formula that integrates weighted features and previous threat level results to ensure that traffic with high-risk features is processed first. Priority value calculation formula:

[0147]

[0148] Among them, P L is the priority weight corresponding to the threat level calculated in the previous step. j The feature f w The weight of (j) (feature weighting from step 2). w (j) is the value of the jth weighted feature. φ is a regularization term, which is expressed as a confidence adjustment term for high-weight features to prevent certain features from over-amplifying their impact in high-threat situations. Z is a normalization constant used to normalize the priority value V i Adjust to a reasonable scale. Through this formula, the system can accurately evaluate the urgency of each data packet, so that the priority depends not only on the threat level, but also combines the weighting of features and the interaction between features. This innovative regularization term φ solves the problem of a single feature over-dominant priority in traditional solutions.

[0149] Furthermore, during the operation of the system, as the network environment changes (such as load fluctuations or the emergence of new threats), it is necessary to dynamically adjust the priority queue. The present invention designs an adjustment mechanism based on real-time network status to ensure that the system can still flexibly adjust the processing order under high load. This mechanism dynamically adjusts the impact factor ξ i And regular term φ, to update the priority queue in real time. Priority adjustment formula:

[0150] V' i =V i +Δ(t)·θ(t)

[0151] Among them, Δ(t) is a real-time adjustment coefficient, which is calculated based on the current network load, network security situation and data packet arrival rate. The changing trend of Δ(t) is that when the system load increases, the Δ(t) value increases, accelerating the processing of high-priority data packets. θ(t) is a security adjustment coefficient that is dynamically updated for traffic and threat types. For example, in the event of a large-scale DDoS attack, the system will increase the weight of θ(t) to ensure that processing resources are preferentially allocated to traffic related to the threat. This formula ensures that the system can dynamically adjust the priority according to the real-time network status, ensuring that the system can still reasonably allocate resources under sudden attacks and high-load scenarios. Through this mechanism, the system has higher adaptability.

[0152] Further, according to the calculated dynamic priority value V' i , sort the data packets from high to low according to the priority value, and generate the final priority processing queue Q final The queue is continuously updated and scheduled to ensure that high-threat traffic is given priority and delays are reduced. Queue processing structure:

[0153] Q final ={(f w ,V' i )|f w ∈F w ,V' i ∈V' i}

[0154] Processing queue Q final Ensure that each data packet is processed according to real-time priority, so that high-threat and high-importance traffic can pass first. Especially in the attack and network high-load environment, this dynamic adjustment mechanism can greatly improve the network's ability to respond to emergencies.

[0155] Through the above dynamic priority adjustment scheme, combined with influencing factors, regular terms and dynamic adjustment mechanisms, the system can not only prioritize traffic according to threat levels, but also adapt to environmental changes under high load. This scheme significantly improves the system's ability to adapt to sudden attacks and busy networks, ensuring that high-priority tasks are responded to quickly.

[0156] S4. Implement coordinated response mechanism.

[0157] Specifically, the system first continuously monitors the status information of each node in the network. The status of each node reflects the current processing capacity, load, and response delay. The status of node i is defined as S i (t), including the following variables:

[0158] S i (t)=(L i (t),C i (t),R i (t))

[0159] Among them, L i (t) represents the load of node i, which indicates the number of packets currently processed or the utilization rate of system resources, and its value range is 0≤L i (t)≤1. C i (t) represents the processing capacity of node i, which indicates the maximum load that the node can bear and is usually a fixed value of the node resource configuration. i (t) represents the response time of node i, which means the time delay from receiving data to processing completion of the current node. Node status S i(t) is updated once every period Δt and broadcast to other nodes through the message bus. The system can judge the health status and resource availability of each node through this status information, providing a basis for subsequent collaborative adjustments.

[0160] Furthermore, when a node i detects a high-threat packet (i.e., V' i When the value exceeds a certain threshold value θ), the node will generate a threat notification packet T i , and broadcast this threat information to other nodes. Notification packet T i Contains the key characteristics of the threat, priority, source, and current node status in the form of:

[0161] T i =(f w ,V' i ,S i (t),t trigger ,λ i )

[0162] Among them, f w Packet feature vector representing high priority threats. V' i S represents the priority score of the threat data packet (calculated from step 3). i (t) represents the current status information of node i, including load, processing capacity and response delay. trigger Indicates the timestamp when the threat event is triggered. i Indicates the threat confidence of the node, indicating the urgency of the threat. The calculation formula is:

[0163]

[0164] This formula introduces the node response time R i (t) acts as a regularization term to ensure that the threat confidence of a node is appropriately adjusted when the response delay is large, thus avoiding unnecessary resource allocation.

[0165] Furthermore, when node j receives the threat notification packet T from node i i When node j is based on its own state S j (t) and the threat information received, dynamically adjust the priority in its processing queue. In order to improve resource utilization efficiency, the system designs a weighted priority adjustment algorithm based on the load, capacity and received threat confidence λ of node j. i Adjust the priority value V j ″:

[0166]

[0167] Among them, V' iThe threat priority reported for node i. is the current load factor of node j, which is used to balance the processing capacity of nodes and prevent high-load nodes from receiving more high-priority tasks. i is the threat confidence of node i. This priority weighted adjustment mechanism ensures that node j will not receive too many high-priority tasks under high load, avoids resource exhaustion of a single node, and ensures that the processing capacity of the entire network is optimally allocated.

[0168] Furthermore, after completing the priority adjustment, node j will update its priority queue Q j , and based on the new priority V j ″Rearrange the task processing order. In order to improve the efficiency of collaborative response, the present invention introduces a dynamic resource allocation algorithm for nodes. The nodes dynamically adjust the available resource amount R according to the threat level and current load j (t), the calculation formula is:

[0169]

[0170] in, is the maximum available resource of node j. α is a tuning parameter used to control the allocation rate of response resources. j ″ is the adjusted priority, and θ is the threshold for resource allocation. This formula uses the sigmoid function to achieve adaptive resource allocation, ensuring that resource allocation increases rapidly when the threat is high and remains stable when the threat is low. Through this dynamic resource allocation algorithm, each node can flexibly allocate resources according to the threat level to avoid resource waste, while ensuring that high-threat traffic receives sufficient processing resources.

[0171] Furthermore, after the node completes the threat response, it generates a feedback information packet F j , and feedback to the central controller and other related nodes. The structure of the feedback package is:

[0172] F j =(T i ,V j ″,R j (t),t complete )

[0173] Among them, T i Indicates the original threat notification packet. j ″ represents the priority of node j that is finally processed. j (t) represents the resource allocation status of the node during processing. complete Indicates the timestamp of processing completion. The central controller analyzes the feedback information packet F j, can optimize the global resource scheduling strategy and optimize the future collaborative response mechanism based on historical data. For example, when the system finds that some nodes have low response efficiency in a specific threat scenario, it can reallocate their weights or adjust the resource allocation strategy of the node.

[0174] Through this collaborative response mechanism, the system can flexibly and efficiently handle high-threat traffic between multiple nodes. Through node status monitoring, threat notification, priority weighted adjustment, dynamic resource allocation and feedback mechanism, the system can be adaptively adjusted, optimize resource utilization, and minimize the delay of threat response. This solution is specifically designed for the real-time collaborative processing needs in network security scenarios, solving the problems of slow response between nodes and uneven resource allocation in existing technologies.

[0175] S5. After the coordinated response is triggered, each node needs to execute its priority queue Q j High-threat packets in the V j After completing the task processing, each node generates feedback information and feeds it back to the central controller and other collaborative nodes. The central controller adjusts the future priority allocation, resource scheduling and node collaboration strategy based on the feedback information provided by each node and the historical processing results.

[0176] Specifically, after the coordinated response is triggered, each node needs to execute its priority queue Q j High-threat packets in the V j In the threat response process, the node needs to calculate the current load status S j (t) Dynamically allocate resources to ensure efficient completion of tasks.

[0177] The response processing mechanism is as follows: each node is based on its processing capacity C j (t) and load condition L j (t), for data packet P i The present invention introduces a weighted task processing model to ensure that tasks of different priorities can be fairly and reasonably allocated resources. The task processing formula is:

[0178]

[0179] Where: P j V (t) is the processing resource allocated by node j to the task at time t; j ″(i) is the adjusted priority of task i (output from step 4). j (t) is the current available resource amount of node j. j(t) is the current load level of node j, reflecting the resource usage of the node. α is a regular term, which is used to balance the load pressure of the nodes and avoid the degradation of system performance due to excessive load on a single node.

[0180] The design of this formula ensures that when the load is high, the priority and processing resources of the task can dynamically adapt to the current network environment. For nodes with higher load (nodes refer to computing units or servers in the system), the α term increases the difficulty of their task processing, so that resources tend to be allocated more to low-load nodes to avoid overall system overload.

[0181] The dynamic resource adjustment mechanism is as follows: In order to ensure that high-priority tasks obtain sufficient resource support in the case of burst traffic, the node's resource allocation mechanism must have adaptive capabilities. Introducing the dynamic adjustment factor ρ j (t), which is used to adjust available resources according to changes in system load. The formula for dynamic resource adjustment is:

[0182] R j '(t)=R j (t)·(1+ρ j (t))

[0183] Among them, R j '(t) is the amount of resources after dynamic adjustment. where λ j (t) indicates the urgency of the task, D j (t) represents the current delay of the system. By combining urgency and delay, the system can ensure that high-priority tasks are still processed in a timely manner in high-load scenarios. Through this resource adjustment mechanism, the system can dynamically allocate resources according to different task characteristics, achieve efficient resource utilization and rapid task response, which is especially important in the case of large-scale threats or network congestion.

[0184] Furthermore, after completing task processing, each node needs to generate feedback information to feed back the processing results, resource consumption, and delay to the central controller and other collaborative nodes. Feedback information set F j The structure is:

[0185] F j =(V j ″(i),R j (t),D j (t),λ j (t),μ j (t))

[0186] Among them, V j ″(i) is the final priority of task i. j (t) is the resource consumption during task execution. j(t) is the delay of task processing. j (t) is the task urgency processing result, with a value of 1 indicating successful processing and 0 indicating failed processing. j (t) is the task execution quality assessment, which scores the task based on resource consumption and processing time to ensure that the system can track the execution quality of each task.

[0187] Furthermore, the quality score μ is performed j (t) aims to provide the system with quantitative feedback on the efficiency of task processing. The formula is as follows:

[0188]

[0189] This score reflects the overall performance of the node in task execution. The higher the value, the more efficient the task is with less resource consumption and shorter latency. By collecting the execution quality of all nodes, the central controller can identify potential performance bottlenecks and optimize future resource allocation strategies.

[0190] Furthermore, the key role of the feedback mechanism is to continuously optimize future response strategies through historical data. j , combined with historical processing results, adjust future priority allocation, resource scheduling and node coordination strategies.

[0191] Among them, according to the feedback execution quality score μ j (t), the central controller can adjust the priority setting of the next task. In particular, for tasks that fail to execute or have poor processing effects, the system can dynamically increase their priority to ensure that they can be processed more quickly when similar threats appear next time. The optimization formula is:

[0192]

[0193] Among them, β is the optimization step coefficient, which controls the amplitude of priority adjustment. j (t) is the urgency processing result of the task, reflecting whether the task is successfully processed. j (t) is the execution quality score, which reflects the processing efficiency of the task. θ is the priority adjustment threshold, and the system adjusts the priority according to this threshold. Through this optimization formula, the system can automatically increase the priority of tasks with low processing efficiency and optimize future response decisions.

[0194] Furthermore, the system not only needs to optimize the priority, but also optimize the future resource allocation strategy based on the resource consumption of each task. j (t), the system can adjust the resource allocation for future tasks:

[0195]

[0196] Among them, γ is the resource optimization step coefficient. j (t) is the resource consumption during task processing. j ″(i) is the priority of the task, reflecting its importance. ζ is the expected resource consumption ratio of the system, ensuring that the resource utilization of the system remains within a reasonable range. By analyzing the relationship between resource consumption and task priority, the system can optimize future resource allocation strategies, avoid resource waste, and ensure that high-priority tasks receive higher resource support.

[0197] Furthermore, as feedback information from each task is accumulated, the system gradually forms a long-term learning mechanism. By analyzing historical feedback data, the system can gradually build a complex threat model and optimize itself through incremental learning algorithms:

[0198] Incremental learning model: Based on the feedback from each task processing, the system will adjust the feature weights and threat model to gradually improve the accuracy of response decisions.

[0199] Feedback-driven optimization: Combining the execution quality and resource allocation information in the feedback, the system dynamically adjusts its parameters after each processing to optimize future response decisions.

[0200] The long-term learning mechanism ensures that the system can self-adjust and optimize in the face of ever-changing network threats, gradually improving its network protection capabilities.

[0201] S6. Perform adaptive learning based on the feedback information and historical feedback information.

[0202] Specifically, first, the system will summarize the feedback data F received from all nodes j , these data include task processing information, resource consumption, response delay and processing results of each node. Through these historical feedbacks, the system can construct the execution history of each node and perform global optimization. The present invention designs a feedback matrix M to store this information:

[0203]

[0204] Among them, V i Indicates the priority of data packet i. i represents the resources consumed when processing task i. i Represents delay. i Indicates the task success flag (1 for success, 0 for failure). i Indicates the processing efficiency score (based on R i and D i ).

[0205] Furthermore, by extracting features from the feedback matrix of historical tasks, the system can identify which tasks require more resources or have higher priority. i and μ i Based on statistics, the system can filter out tasks that have failed multiple times or have low processing efficiency and mark them as tasks that need to be optimized.

[0206] Furthermore, during the long-term operation of the system, the priority and processing strategy of each task need to be dynamically adjusted to ensure the rationality of resource allocation. The present invention optimizes the priority of tasks through historical data and uses an adaptive adjustment mechanism to update future task strategies. Priority optimization formula:

[0207]

[0208] in, represents the priority of task i in the next cycle. α represents the optimization step size, which controls the magnitude of priority adjustment. i A flag indicating whether the task processing is successful or not. i represents the processing efficiency score. θ represents the ideal score threshold expected by the system. The core idea of ​​this optimization formula is to dynamically adjust the priority of tasks according to the success rate and processing efficiency of the tasks. i Lower than the system expectation, indicating that there is a bottleneck in task processing and the priority needs to be increased. i , to ensure that such tasks can be processed faster next time. Feature weight update formula:

[0209]

[0210] Among them, W f,i represents the feature weight of task i (such as IP address, traffic characteristics, etc.). β represents the learning rate, which controls the update speed of feature weights. μ i Represents the processing efficiency score, which reflects the task processing effect. i Indicates the resource consumption of the task. i represents the task processing delay. ζ represents the expected score of the feature, ensuring that the feature weight is not over-adjusted. Through this formula, the system can dynamically adjust the features that affect processing efficiency (such as network traffic features, historical attack patterns, etc.), thereby optimizing future response decisions. This solves the problem of over-reliance on static features in traditional solutions and difficulty in coping with ever-changing threat scenarios.

[0211] Furthermore, in addition to priority optimization, the system also needs to adjust future resource allocation strategies based on resource utilization. The present invention designs an adaptive resource scheduling mechanism based on feedback data to ensure that system resources are optimally allocated. Adaptive resource adjustment formula:

[0212]

[0213] in, represents the amount of resources allocated to node j in the next cycle. γ represents the resource adjustment coefficient. V i Represents the priority of task i. j Indicates the current task resource consumption. j Indicates the delay of the current task. This mechanism ensures a dynamic balance in resource allocation. When processing high-priority tasks, nodes can flexibly adjust their resource allocation based on historical feedback to ensure that the system can allocate more resources when processing urgent tasks.

[0214] Furthermore, the system needs to rely on incremental learning to gradually optimize the decision model in the continuous historical data. Through incremental learning, the system can adapt to new network threats and security scenarios without rebuilding the model. Incremental learning model:

[0215]

[0216] Among them, M represents the current feedback matrix; η represents the learning rate, which controls the model update amplitude. μ represents the processing quality score of the current task. V represents the task priority. λ represents the sign of whether the task processing is successful or not. Through incremental learning, the system can gradually correct its threat detection and response model to ensure that new network attacks can be detected and processed more quickly and accurately in the future. This solves the problem of processing lag caused by outdated threat models and fixed response strategies in traditional systems.

[0217] Furthermore, to ensure that system optimization and self-learning effects truly improve processing capabilities, the system will periodically evaluate the performance of the self-learning algorithm. The core indicators of the evaluation include:

[0218] Processing efficiency improvement rate: By comparing the average latency and resource consumption of processing tasks, evaluate whether the system's processing efficiency has improved after self-learning.

[0219] Priority scheduling effect: Analyze whether the priority allocation after multiple optimizations is reasonable, especially whether high-priority tasks receive faster responses.

[0220] Improve resource utilization: Evaluate the optimization effect of resource scheduling strategy through the relationship between resource consumption and task success rate.

[0221] The evaluation results are fed back into the incremental learning model, ensuring that the system can further optimize its decision-making process in each cycle.

[0222] Furthermore, in order to cope with the ever-changing network environment, the system needs to not only adjust priorities and resources in the long run, but also continuously optimize the processing weights of task features. This invention introduces an innovative feature optimization mechanism. By introducing uncommon regularization terms, the system can dynamically identify new threat patterns and adapt. Feature optimization formula:

[0223]

[0224] Where, ΔW f Represents the feature weight update amount. f Represents the feature learning rate. L f Indicates the processing failure rate of this feature in historical tasks. f represents the total number of times the feature is processed. ∈ represents a constant to prevent division by zero. This formula introduces the feature failure rate L f , ensuring that the system can automatically detect which features are related to task processing failures and prioritize their weights. This innovative feature optimization mechanism enables the system to be more agile and quickly adapt to new environments when dealing with unknown threats.

[0225] The system optimization and self-learning steps ensure the system's long-term adaptability in responding to new threats through the integration of feedback information, optimization of priorities and resources, and the introduction of self-learning algorithms. Through long-term analysis of feedback and model optimization, the system gradually improves its response efficiency and resource utilization, forming a closed-loop optimization.

[0226] In a second aspect of the present invention, an embodiment is provided, specifically a priority asynchronous processing system for network security, the system comprising:

[0227] The network data collection module 101 is used to collect real-time data by using a stream processing framework, preprocess the real-time data, and output the preprocessed data, wherein the preprocessed data is a data set, and the data set includes selected features and a label for each feature;

[0228] The feature weighting module 102 is used to group the selected features into a feature data set and a corresponding label data set, design a weighted scoring algorithm for the feature data set and the corresponding label data set, calculate the weight of each feature by analyzing the mutual information of the features and the historical attack detection rate, obtain the weighted feature set of each feature according to the weight of each feature, and then build a threat classification model to calculate the threat score of each feature, and obtain the threat level of each feature according to the comparison of the threat score of each feature with the dynamic threshold;

[0229] The priority processing module 103 is used to assign a priority weight to each data packet according to the threat level of each feature combined with the current network load status, historical processing records and current security risks, and then adjust the priority weight of each data according to the weighted feature set of each feature and the real-time network status. Finally, the data packets are arranged from high to low according to the priority, and the final priority processing queue is generated to ensure that good threats with high priority are processed first;

[0230] The priority processing module specifically performs the following steps:

[0231] S301. Introduce impact factor ξ according to the threat level of each feature i , assign a priority weight P to each packet L , ensuring that the highest threat data packets receive the highest processing priority;

[0232] S302: Allocate priority weight P to each data packet L Combine the weight of each feature to calculate the priority value V i , combining the preliminary priority value with the dynamic environment of the network, designing an adjustment mechanism based on the real-time network status, ensuring that the processing order is dynamically adjusted under high load, and outputting the dynamic priority value V′ adjusted by the adjustment mechanism based on the real-time network status i ;

[0233] S303, based on the calculated dynamic priority value V′ i , sort the data packets from high to low according to the priority value, and generate the final priority processing queue Q final ; Wherein, the priority processing queue Q final Includes the dynamic priority value V' of each data packet i , the weight of the feature f w and corresponding threat levels;

[0234] The collaborative processing module 104 is used to execute the collaborative response mechanism, specifically:

[0235] Monitor the status information of each node in the network, which includes the current processing capacity, load and response delay. When a node detects a high-threat data packet, the current node generates a threat notification packet and broadcasts the threat information to other nodes. When other nodes receive the threat notification packet from the current node, they will dynamically adjust the priority of their processing queue based on their own status and the received threat information. After completing the priority adjustment, other nodes update their priority processing queue Q j, and rearrange the task processing order based on the new priority value, and generate a feedback information packet after other nodes complete the threat response, and feed it back to the central controller and other related nodes; wherein the high threat data packet is a dynamic priority value V′ i Exceeding a preset threshold value θ;

[0236] The node processing module 105 is used to execute the priority queue Q of each node after the coordinated response is triggered. j High-threat packets in the V j After completing the task processing, each node generates feedback information and feeds it back to the central controller and other collaborative nodes. The central controller adjusts the future priority allocation, resource scheduling and node collaboration strategy based on the feedback information provided by each node and the historical processing results.

[0237] The adaptive optimization module 106 is used to perform adaptive optimization according to the feedback information combined with historical feedback information.

[0238] In summary, the present invention proposes a priority dynamic processing and collaborative response system based on intelligent threat situation perception. The system integrates multiple data sources (such as intrusion detection systems, user behavior analysis, and network traffic monitoring) to evaluate the threat level of each data packet in real time, and dynamically adjusts its processing priority accordingly. Unlike traditional static methods, the present invention uses advanced machine learning algorithms to perform dynamic evaluations in multiple dimensions, timely identify high-risk data packets and give priority to them. This mechanism significantly improves the system's ability to respond to new and complex attacks. At the same time, the present invention also introduces a multi-node collaborative attack response mechanism. When a node detects abnormal traffic, it can automatically notify other nodes and share threat situation information, thereby achieving rapid collaborative response. This integrated innovation not only enhances the overall security of the network, but also optimizes the efficiency of data packet processing, effectively solves the main defects in traditional network security systems, and provides new ideas for building a more secure and flexible network environment.

[0239] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A priority asynchronous processing method for network security, characterized in that: The method comprises: S1. Collect real-time data by using a stream processing framework, preprocess the real-time data, and output the preprocessed data, where the preprocessed data is a data set, and the data set includes selected features and a label for each feature; S2. The selected features are combined into a feature data set and a corresponding label data set. A weighted scoring algorithm is designed for the feature data set and the corresponding label data set. The weight of each feature is calculated by analyzing the mutual information of the features and the historical attack detection rate. The weighted feature set of each feature is obtained according to the weight of each feature. Then, a threat classification model is constructed to calculate the threat score of each feature. The threat level of each feature is obtained by comparing the threat score of each feature with the dynamic threshold. S3. Assign priority weights to each data packet based on the threat level of each feature combined with the current network load status, historical processing records, and current security risks. Then adjust the priority weight of each data packet based on the weighted feature set of each feature and the real-time network status. Finally, arrange the data packets from high to low priority to generate the final priority processing queue to ensure that high-priority threats are processed first. Wherein, the S3 specifically includes: S301. Introduce impact factor ξ according to the threat level of each feature i , assign a priority weight P to each packet L , ensuring that the highest threat data packets receive the highest processing priority; S302: Allocate priority weight P to each data packet L Combine the weight of each feature to calculate the priority value V i , combining the preliminary priority value with the dynamic environment of the network, designing an adjustment mechanism based on the real-time network status, ensuring that the processing order is dynamically adjusted under high load, and outputting the dynamic priority value V′ adjusted by the adjustment mechanism based on the real-time network status i ; S303, based on the calculated dynamic priority value V′ i , sort the data packets from high to low according to the priority value, and generate the final priority processing queue Q final ; Wherein, the priority processing queue Q final Includes the dynamic priority value V' of each data packet i , the weight of the feature f w and corresponding threat levels; S4. Implement the coordinated response mechanism, specifically: Monitor the status information of each node in the network, which includes the current processing capacity, load and response delay. When a node detects a high-threat data packet, the current node generates a threat notification packet and broadcasts the threat information to other nodes. When other nodes receive the threat notification packet from the current node, they will dynamically adjust the priority of their processing queue based on their own status and the received threat information. After completing the priority adjustment, other nodes update their priority processing queue Q j , and rearrange the task processing order based on the new priority value, and generate a feedback information packet after other nodes complete the threat response, and feed it back to the central controller and other related nodes; wherein the high threat data packet is a dynamic priority value V′ i Exceeding a preset threshold value θ; S5. After the coordinated response is triggered, each node needs to execute its priority queue Q j High-threat packets in the V j After completing the task processing, each node generates feedback information and feeds it back to the central controller and other collaborative nodes. The central controller adjusts the future priority allocation, resource scheduling and node collaboration strategy based on the feedback information provided by each node and the historical processing results. S6. Perform adaptive learning based on the feedback information and historical feedback information.

2. A priority asynchronous processing method for network security according to claim 1, characterized in that: The real-time data includes: network traffic and potential attack behaviors in the network traffic, user behavior patterns and abnormal behaviors in the user behavior patterns, and real-time network data packets; The preprocessing includes: data cleaning and standardization processing, using mutual information measurement to evaluate the correlation between each feature and the label after standardization processing, the label is normal traffic or attack traffic, selecting the top k features with higher correlation, and then performing PCA dimensionality reduction processing on the selected features, and finally outputting the preprocessed data.

3. A priority asynchronous processing method for network security according to claim 1, characterized in that: The weighted scoring algorithm is expressed as follows: W i =α·I(F i ,Y)+β·T i +γ·R i Among them, I(F i ,Y) is the feature F i The mutual information with label Y reflects the contribution of the feature to attack identification; T i For feature F i Attack detection rate in historical data; R i is a regular term, indicating the feature F i The stability in the most recent time window is calculated as the inverse of the feature change rate; α, β, γ are weight coefficients to ensure the balance between stability and contribution; The threat classification model is constructed as follows: Decision tree, random forest and support vector machine are selected as basic classifiers to output the threat score S of each sample. The calculation formula is: Among them, C m (F w ) represents the weighted feature set F of the mth basic classifier w The classification result, M is the number of basic classifiers; Add a regular term R to the threat classification model S , which is used to adjust the model's sensitivity to abnormal samples. The calculation formula for the modified score S′ is: S′=S-λ·R S Among them, λ is a hyperparameter, R S is the ratio of anomaly classifications in historical data by the model.

4. A priority asynchronous processing method for network security according to claim 3, characterized in that: After calculating the threat score of each feature, a dynamic threshold calculation mechanism based on the ROC curve is used, which is expressed as follows: θ=median(S′)+k·std(S′)+δ Among them, δ is a specific adjustment factor, which depends on the change of attack mode in the recent period of time By comparing the current threat score S′ with the dynamic threshold θ, the threat level L of each sample is obtained, which is defined as:

5. A priority asynchronous processing method for network security according to claim 1, characterized in that: According to the threat level of each feature, the impact factor ξ is introduced i , assign a priority weight P to each packet L , the specific allocation is as follows: Among them, P low ,P medium ,P high is the preset basic priority value; i is the impact factor, defined as: Among them, λ is the adjustment coefficient of the historical processing load, η(t) represents the current system network load, ensuring that the system can adjust the priority more sensitively when the load is high; According to each data packet, a priority weight P is assigned L Combine the weight of each feature to calculate the priority value V i , set up as follows: Among them, W j The feature f w The weight of (j); f w (j) is the value of the jth weighted feature; φ is a regularization term, which is expressed as a confidence adjustment term for high-weight features; Z is a normalization constant used to normalize the priority value V i Adjust to a reasonable scale; The preliminary priority value is combined with the dynamic environment of the network, and an adjustment mechanism based on the real-time network status is designed to ensure that the processing order is dynamically adjusted when the load is high, and the dynamic priority value V′ adjusted by the adjustment mechanism based on the real-time network status is output. i , which is expressed as follows: V′ i =V i +Δ(t)·θ(t) Among them, Δ(t) is the real-time adjustment coefficient, which is calculated based on the current network load, network security situation and data packet arrival rate; θ(t) is the security adjustment coefficient dynamically updated according to traffic and threat type; The changing trend of the real-time changing adjustment coefficient Δ(t) is that when the load increases, the Δ(t) value increases, and the data packets with high priority are processed first.

6. A priority asynchronous processing method for network security according to claim 1, characterized in that: The threat notification package T i Contains the key features, priority, source, current node status and threat confidence of the current node; the threat confidence of the current node λ i Indicates the urgency of the threat, and the calculation formula is: Among them, R i (t) is the response time of the node; When other nodes receive a threat notification packet from a node, the node will dynamically adjust the priority of its processing queue based on its own state and the received threat information, as shown below: According to the load, capability and received threat confidence λ of node j i Adjust to the new priority value V j ″, calculated as follows: Among them, V′ i The dynamic priority value reported for node i; is the current load factor of node j, which is used to balance the processing capacity of nodes and prevent high-load nodes from receiving more high-priority tasks; i is the threat confidence of node i.

7. A priority asynchronous processing method for network security according to claim 6, characterized in that: According to the new priority value V j After the priority is adjusted, a dynamic resource allocation algorithm is introduced for the node: The node dynamically adjusts the available resources R according to the threat level and current load j (t), the calculation formula is: in, is the maximum available resource of node j; α is the adjustment parameter used to control the allocation rate of response resources; V j ″ is the adjusted priority, θ is the threshold of resource allocation.

8. A priority asynchronous processing method for network security according to claim 1, characterized in that: The S5 specifically includes: S501, in the coordinated response trigger, the current node needs to be based on the current load state S j (t) Dynamically allocate resources, each node based on its processing capacity C j (t) and load condition L j (t), for data packet P i Perform resource allocation and introduce dynamic adjustment factor ρ j (t) Adjust available resources according to load changes; S502, after completing task processing, each node generates feedback information and adds an execution quality score to quantify the node task processing efficiency, which is expressed as follows: Among them, μ j (t) is the execution quality score, V j ″(i) is the final priority value of the current task, R j (t) is the resource consumption during task execution, D j (t) is the delay in task processing; S503, based on the obtained execution quality score μ j (t), the central controller adjusts the priority setting of the next task, as shown below: Among them, β is the optimization step coefficient, which controls the amplitude of priority adjustment; λ j (t) is the urgency processing result of the task, reflecting whether the task is successfully processed; θ' is the priority adjustment threshold, and the priority is adjusted according to this threshold; At the same time, the resource consumption of each task is used to optimize the future resource allocation strategy, and the resource consumption R in the feedback information is used to optimize the future resource allocation strategy. j (t), adjust the resource allocation of future tasks, expressed as follows: Among them, γ is the resource optimization step coefficient; R j (t) is the resource consumption during task processing; V j ″(i) is the priority value of the task, reflecting its importance; ζ is the expected resource consumption ratio, ensuring that resource utilization remains in a reasonable range.

9. A priority asynchronous processing method for network security according to claim 1, characterized in that: The S6 specifically includes: S601, summarizing the feedback data received by all nodes and designing a feedback matrix M to store it; S602, optimizing the priority of tasks through historical data and resource utilization, and updating future task strategies using an adaptive adjustment mechanism; S603, using incremental learning to update the feedback matrix M; S604: Introduce a feature optimization mechanism to dynamically identify new threat patterns and adapt, as shown below: Where, ΔW f represents the feature weight update amount; λ f represents the feature learning rate; L f represents the processing failure rate of this feature in historical tasks; T f Indicates the total number of times the feature is processed; ∈ indicates a constant to prevent division by zero.

10. A priority asynchronous processing system for network security, characterized in that: The system comprises: The network data collection module is used to collect real-time data by using a stream processing framework, preprocess the real-time data, and output the preprocessed data, wherein the preprocessed data is a data set, and the data set includes selected features and labels for each feature; The feature weighting module is used to group the selected features into feature data sets and corresponding label data sets, design a weighted scoring algorithm for the feature data sets and the corresponding label data sets, calculate the weight of each feature by analyzing the mutual information and historical attack detection rate of the features, obtain the weighted feature set of each feature according to the weight of each feature, and then build a threat classification model to calculate the threat score of each feature, and obtain the threat level of each feature by comparing the threat score of each feature with the dynamic threshold; The priority processing module is used to assign a priority weight to each data packet according to the threat level of each feature combined with the current network load status, historical processing records and current security risks, and then adjust the priority weight of each data according to the weighted feature set of each feature and the real-time network status. Finally, the data packets are arranged from high to low according to priority to generate the final priority processing queue to ensure that high-priority threats are processed first; The priority processing module specifically performs the following steps: S301. Introduce impact factor ξ according to the threat level of each feature i , assign a priority weight P to each packet L , ensuring that the highest threat data packets receive the highest processing priority; S302: Allocate priority weight P to each data packet L Combine the weight of each feature to calculate the priority value V i , combining the preliminary priority value with the dynamic environment of the network, designing an adjustment mechanism based on the real-time network status, ensuring that the processing order is dynamically adjusted under high load, and outputting the dynamic priority value V′ adjusted by the adjustment mechanism based on the real-time network status i ; S303, based on the calculated dynamic priority value V′ i , sort the data packets from high to low according to the priority value, and generate the final priority processing queue Q final ; Wherein, the priority processing queue Q final Includes the dynamic priority value V' of each data packet i , the weight of the feature f w and corresponding threat levels; The collaborative processing module is used to execute the collaborative response mechanism, specifically: Monitor the status information of each node in the network, which includes the current processing capacity, load and response delay. When a node detects a high-threat data packet, the current node generates a threat notification packet and broadcasts the threat information to other nodes. When other nodes receive the threat notification packet from the current node, they will dynamically adjust the priority of their processing queue based on their own status and the received threat information. After completing the priority adjustment, other nodes update their priority processing queue Q j , and rearrange the task processing order based on the new priority value, and generate a feedback information packet after other nodes complete the threat response, and feed it back to the central controller and other related nodes; wherein the high threat data packet is a dynamic priority value V′ i Exceeding a preset threshold value θ; The node processing module is used to execute the priority queue Q of each node after the coordinated response is triggered. j High-threat packets in the V j After completing the task processing, each node generates feedback information and feeds it back to the central controller and other collaborative nodes. The central controller adjusts the future priority allocation, resource scheduling and node collaboration strategy based on the feedback information provided by each node and the historical processing results. The adaptive optimization module is used to perform adaptive optimization according to the feedback information combined with historical feedback information.

Images