Network security situation generation method based on multi-view monitoring

Abstract

The invention relates to the technical field of network security situation generation, in particular to a network security situation generation method based on multi-view monitoring. The method comprises the following steps of: constructing a multi-view data acquisition system, acquiring real-time information from a multi-dimensional data source, and comprehensively capturing potential threats by utilizing an intelligent sensing technology; cleaning, noise filtering and feature extraction are performed on the acquired data based on a dynamic threshold self-adaption multi-factor cleaning method, so that the accuracy and consistency of the data are ensured; a dynamic analysis algorithm based on deep learning is adopted, the incidence relation between the security events is mined, and the development trend of potential threats is predicted; constructing a joint learning model, and comprehensively evaluating the security state of the network environment; the security situation is dynamically displayed by using a visualization technology, and a security policy is quickly generated in combination with an automatic early warning and response mechanism to resist threats. According to the method, accurate evaluation and prediction of the network security situation are realized, and support is provided for security decision-making in a complex network environment.

Description

Technical Field

[0001] The present invention relates to the technical field of network security situation generation, and in particular to a network security situation generation method based on multi-view monitoring. Background Art

[0002] With the rapid development of the Internet and information technology, the network has become an important infrastructure for the operation of modern society. However, the complexity and diversity of network security are increasing, and the means of attack are becoming increasingly complex and hidden. In order to cope with the ever-changing security challenges, traditional network security protection technologies, such as firewalls, intrusion detection systems and antivirus software, have played an important role in specific scenarios. However, in response to the diverse needs of the current complex network security environment, there are still some challenges and room for improvement: (1) Insufficient coordination of multi-level security monitoring: The monitoring perspective of current network security technology is usually focused on a certain level or specific dimension, such as traffic analysis at the network layer or log monitoring at the application layer. This single-level monitoring method may have certain limitations in capturing the full picture of security threats, especially in the correlation analysis of cross-level and multi-dimensional data. There is potential for further optimization.

[0003] (2) Data integration and association mechanisms need to be strengthened: Since network security monitoring technologies are distributed at different levels, such as the network layer, device layer, and user behavior layer, data lack a unified identifier and an efficient association mechanism between systems, which may lead to a certain degree of dispersion in the data fusion process. This increases the complexity of multi-level data integration and feature analysis.

[0004] (3) The ability to detect unknown threats needs to be improved: Many current technologies rely on known threat signature libraries or rule matching. Responses to advanced persistent threats (APTs) and zero-day attacks remain a research focus in the field of network security. In complex attack scenarios, there is still much room for improvement in the ability to detect multi-step operations and covert behaviors.

[0005] (4) Real-time and dynamic response capabilities: As the cyber attack situation changes rapidly, network security technology needs to continuously improve its dynamic response capabilities to achieve faster and more effective threat defense and security policy adjustments.

[0006] (5) Large-scale data processing and intelligent analysis: With the continuous growth of data scale and diversity in network environments, how to efficiently process massive, multi-dimensional data and perform advanced feature extraction has become an important direction for realizing intelligent network security situation generation.

[0007] To sum up, in order to meet the needs of the current network security environment, there is an urgent need for an innovative network security situation generation technology that can integrate multi-level data collection, cross-level fusion and advanced feature extraction, and combine advanced technologies such as joint learning to improve the detection capability of complex attacks. At the same time, through real-time situation generation and dynamic response mechanism, the intelligence and decision-making support capabilities of network security management can be further enhanced. Summary of the invention

[0008] The purpose of the present invention is to propose a network security situation generation method based on multi-view monitoring in response to the problems existing in the background technology.

[0009] The technical solution of the present invention is a method for generating network security situation based on multi-view monitoring, comprising the following specific implementation steps: S1, monitor and collect data from five perspectives: network traffic, malicious code, network performance, network routing and network logs; S2. Preprocess and standardize the collected data; Preprocess and standardize the collected data, and clean the collected raw data based on a dynamic threshold adaptive multi-factor cleaning method; S3, logically stratify the processed raw data, including network layer, application layer, device layer, user behavior layer and environment layer; S4, integrating the data of the network layer, application layer, device layer, user behavior layer and environment layer through association identifiers and time windows to build a unified association relationship; S5. Perform time series modeling on the fused multi-view data to capture the dynamic characteristics of data changing over time; S6, extract basic information, advanced features and dynamic features to provide input for model learning; S7. Use comprehensive features to build a joint learning model. In the model learning stage, a joint learning strategy of shared network and multi-task branches is adopted. Common features are extracted through the shared layer and combined with task-specific branches for detailed analysis to identify abnormal behaviors, detect unknown threats, and predict potential risks. S8. Generate network security situation based on statistical analysis and model prediction results. Combine the dynamic prediction results of model learning with the information generated by static analysis to form a network security situation. The generated situation information covers abnormal event identification and alarm, asset quantity and level distribution, vulnerability quantity and level distribution, risk assessment and level classification, and threat trend prediction.

[0010] Preferably, the specific implementation steps of logical stratification are as follows: S21. After data preprocessing is completed, the data from network traffic monitoring, malicious code detection, network performance monitoring, network routing monitoring and network log monitoring are divided into network layer, application layer, device layer, user behavior layer and environment layer according to attributes and analysis objectives: S22. Network layer management and communication activity-related data, including network traffic patterns, protocol behaviors, and routing table updates. Network layer data is derived from network traffic monitoring and network routing monitoring, reflecting overall traffic characteristics and link operation status. S23, the application layer centrally stores data related to the application running status, including data from network performance monitoring and network log monitoring; S24. The device layer manages data related to the device operation status and security threats, including the operation logs, communication records and internal alarm information of IoT devices, and classifies the data from malicious code detection into the device layer to monitor the operation security and potential threats of the device; S25, the user behavior layer stores user identity and operation behavior data; S26, the environment layer includes external context information and environment data, and the environment layer data comes from network routing monitoring and network log monitoring; S27. Assign the data from different monitoring perspectives to their respective corresponding levels.

[0011] Preferably, the implementation process of integrating the data of the network layer, application layer, device layer, user behavior layer and environment layer through the association identifier and time window is as follows: S31, aligning the data layers that have unified timestamp and identifier fields after the data preprocessing stage, and establishing preliminary logical associations between records from different sources based on the common identifiers in the data; Network layer IP address net Login IP address of the user behavior layer user Aligned, and the device ID of the device layer, that is, DeviceID device , and the device ID recorded in the application layer, i.e. DeviceID app , to match, and build a preliminary identifier mapping relationship through the consistency of field values; S32. After the identifiers are aligned, the time difference problem between data from different sources is solved through time window matching. To ensure the consistency of the dynamic event chain, a reasonable time window ΔT is set to associate the records whose time difference is within the tolerance range; When the login event time T of the user behavior layer user and the traffic event time T of the network layer net , if |T user -T net | ΔT, then the two records are considered to be temporally related, and the matching in the time dimension enhances the dynamic consistency of the related data; S33. Based on identifier alignment and time window matching, the depth of the inter-layer data is associated.

[0012] Preferably, the association process of the depth association of the inter-layer data is as follows: S41, establishing an association between the application layer and the user behavior layer, the log data of the application layer is matched with the login record and operation log of the user behavior layer through the user ID, i.e., UserID, and the session ID, SessionID; S42. The device layer and the network layer are associated through the device ID and the IP address: the running state of the device layer is matched with the device identifier of the flow record of the network layer through the device ID, i.e., DeviceID, and the following association conditions are met: DeviceID device =DeviceID net ; IP device =IP net ; Where, IP device Indicates the IP address of the device layer; DeviceID net Indicates the device ID of the network layer; DeviceID device Indicates the device ID of the device layer; Afterwards, the temporal consistency of the association is ensured through time window matching; S43, the association between the network layer and the user behavior layer is established through the login IP address and network traffic records. The source IP in the login event of the user behavior layer, i.e., IP uesr , and the source IP of the network layer traffic record, i.e. IP net , to match, the following conditions are met: IP net =IP uesr ; S44, ensuring that user operations and network behaviors are associated in the time dimension through time window matching; S45, the environment perception layer provides context information for all layers through the node identifier in the topology structure, namely NodeID, and the IP address in the external threat intelligence, namely IP env , establish associations with other layer data; Among them, malicious IP, that is, IP env Directly match the source IP in the network layer traffic, that is, IP net , the associated conditions are as follows: IP env =IPnet ; S46, through the malicious identification DeviceID env Associated with the device layer, and then matched to the login record of the user behavior layer: NodeID env ∈{DeviceID, IP, UserID}; Where, NodeID env Indicates the malicious node identifier; Based on this, the threat source can be quickly identified and located, and the scope of threat impact can be determined through contextual information.

[0013] Preferably, the construction process of time series modeling is as follows: S51, extracting event records from the result of cross-layer data association, and generating a time series in chronological order; The output of cross-layer data association contains a set of event records R assoc , each record r i Includes the timestamp T of the event i , comprehensive feature vector F i , and the associated identifier ID i : R assoc ={r1, r2, …, r n}, r i =(T i , F i , ID i ); Among them, the comprehensive feature vector F i =[f net , f app , f device , f user , f env ] is a multi-level feature generated in the cross-layer association process, according to the timestamp T i Sort a collection of records to generate a global time series: S={(T1,F1),(T2,F2),…,(T n , F n )}, T1≤T2≤…≤T n ; S52. Based on the generated time series, a time series model is constructed to extract dynamic characteristics. The time series is first divided into several subsequences according to a fixed time window ΔT. Each time window contains all events within its range. For each time window [T t , T t +ΔT], whose subsequence is defined as: S t ={(Ti , F i )}|T t ≤T i <T t +ΔT; Among them, T t Indicates the start time of the time window, T t +ΔT is the end time, subsequence S t Contains all events that meet the conditions; S53, after the time window segmentation is completed, generate a comprehensive feature sequence X in each time window t , used for subsequent dynamic analysis and feature extraction, the representation of the feature sequence is as follows: X t =[F i , F j , …, F k ],i,j,k∈S t ; Among them, F i It is the comprehensive feature vector of events in the time window, arranged in the chronological order of the events.

[0014] Preferably, the process of extracting basic information, advanced features and dynamic features is as follows: S61. Extract multi-dimensional and multi-level features from the results of cross-layer data association and dynamic analysis to provide comprehensive and accurate data support for subsequent model training and situation generation; Feature extraction is divided into three parts: extracting basic information directly from the processed raw data; extracting time series features and behavior pattern features from the built time series module; extracting statistical features, association relationship features, graph features, context features and resource features from cross-layer data association to construct a comprehensive feature vector F; S62, after feature extraction is completed, preparing training data and labels for the model learning phase; S63. For the abnormal event identification and alarm task, the historical attack logs and the alarm records of the intrusion detection system mark the samples for abnormal behavior. The label of the normal behavior sample is defined as y=0, and the label of the abnormal behavior sample is defined as y=1. The label of the risk assessment task is defined as the overall risk score and the corresponding risk level y; The scoring labels are calculated based on the impact and severity of historical events, while the risk level y is discretized using predefined thresholds, including: Low risk, i.e. y=1; Medium risk, i.e. y=2; High risk, i.e. y=3; S64. For threat analysis and prediction tasks, historical threat events and their time series changes provide prediction targets for samples, and the labels are defined as threat types y threat and the time series target value T trend ; Threat Type Label threat Classification and annotation based on historical threat types: y threat ∈{1,2,…,C}; Where C represents the number of threat categories; Time series target value T trend Based on the time series data of historical threat frequency, it is annotated through trend analysis algorithm; S65. After the label generation is completed, the data is divided into training set, validation set and test set according to task requirements.

[0015] Preferably, the construction process of the comprehensive feature vector F is as follows: S71. Basic Information F basic , the basic features directly extracted from the original data, including: The basic elements of network communication are recorded as f ip_port ; Network protocol type, recorded as f protocol ; The distribution of packet sizes f packet_size ; Flow directionf traffic_dir ; Based on this, we can get feature F basic =[f ip_port , f protocol , f packet_size , f traffic_dir ]; S72, time series feature F time ,The dynamic characteristics extracted from time series modeling,time series features include: The peak flow time f time_peak ; The distribution of time intervals between events f time_interval ; The standard deviation of the operating frequency within the time window is f time_frequency ; Based on this, we can get the feature F time =[f time_peak , f time_interval , f time_frequency ]; S73, Behavior Pattern Characteristics F behavior , extracting the causal relationship between dynamic events, its specific features include: The path length f in the attack link benavior_path ; Node Dependencyf benavior_dependency ; Key behavior trigger probability f benavior_trigger ; Based on this, we can get the feature F behavior =[f benavior_path , f benavior_dependency , f benavior_trigger ]; S74, Statistical Features F stat , extract the distribution and aggregation characteristics of the data, including: The mean packet size f mean_packet ; The variance of the total flow rate f var_traffic ; The count of abnormal events within a specific time window f count_anomaly ; Based on this, we can get the feature F stat =[f mean_packet , f var_traffic , f count_anomaly ]; S75, association relationship feature F assoc , that is, the association patterns between different data layers, including: Frequent patterns of user behavior and device state changes user_device ; Conditional probability f of API calls and traffic anomalies API_traffic ; The frequency of interaction between specific resources f resource_freq ; Based on this, we can get the feature F assoc =[f user_device , f API_traffic , f resource_freq ]; S76, graph feature F graph , a graph structure generated based on cross-layer associations, with specific features including: The degree of the node f graph_degree ; The average clustering coefficient f of the graph graph-cluster ; Distribution of the shortest paths between nodes f path_dist ; Based on this, we can get the feature F graph =[f graph_degree , f graph-cluster , f path_dist ]; S77, context feature F context , providing a global view of network context and external threats, with specific features including: Whether the device hits the external threat intelligence databasethreat_match ; The frequency of dynamic changes in network topology f topology ; Physical parameters of the equipment operating environment environment ; Based on this, we can get the feature F context =[f threat_match , f topology , f environment ]; S78, Resource Characteristics F resource , extract the resource distribution and status in the network, including: Number of devices resource_count ; The priority level of the core device is f resource_priority ; The current running status of the resource resource_status ; Based on this combination, we get F resource =[f resource_count , f resource_priority , f resource_status ]; S79. Eliminate the dimensional differences between different features through feature normalization and encoding, standardize numerical features to a distribution with a mean of 0 and a standard deviation of 1, or normalize to the interval [0,1]; use one-hot encoding for categorical features, and use TF-IDF for vectorization of text features; Get the comprehensive feature vector F=[F basic , F time , F behavior , F stat , F assoc , F graph , F context , F resource ].

[0016] Preferably, the construction process of the joint learning model is as follows: S81, input comprehensive feature vector F = [F basic , F time , F behavior , F stat , F assoc , F graph , F context , F resource ], the features are standardized and encoded, the numerical features are mapped to the [0,1] interval through normalization operations, and the categorical features are represented by one-hot encoding: ; f i =[1,2,…,0] T ; in, represents the features after normalization; f i Represents the original vector of the i-th feature; After processing, all features are merged into the feature matrix X∈R N×p ; Among them, N is the number of samples, p is the feature dimension; S82, the shared representation layer is responsible for extracting task-independent general information from the input features and generating a shared representation H shared , high-dimensional feature mapping is performed on the input feature matrix X through the fully connected layer: H (1) =σ(W (1) X+b (1) ); Among them, W (1) ∈R N×p represents the weight matrix, N represents the number of samples, and p represents the feature dimension; S83, introduce the multi-head attention mechanism, and strengthen the correlation between features by calculating the attention weight. The output feature after the multi-attention mechanism is H shared ; The attention score a of each head ij The calculation is as follows: ; Among them, score(h i ,h j ) represents the feature h i and h j Similarity measure between ; The output of multi-head attention is: H (2) =Concat(head1,head2,…,head M )W0; Where M represents the number of attention heads; W0 represents the projection matrix; S84. Based on the shared representation layer, an independent branch network is designed for each task for modeling and optimization of specific tasks: S8401, abnormal event identification and alarm: input is shared to indicate H shared and time series features F time , combined with the behavioral pattern characteristics F behavior , that is, input feature: H event =[H shared , F time , F behavior ]; Then, a hybrid model is used to capture time dependency and causality, and the anomaly detection output is: yevent =σ(W event H event +b event ); In the formula, y event Indicates whether the event is abnormal, y event ∈[0,1];W event and b event Model parameters that represent the model's abnormal event recognition and alarm; S8402, Risk Assessment and Classification: Using Shared Representation H shared , Statistical features F stat , contextual features F context and resource characteristics F resource Perform risk scoring and classification to obtain the risk assessment input feature H risk =[H shared ,F stat ,F context ,F resource ], the shared representation input is: R=W risk H risk +b risk ; Where R represents the risk score; W risk and b risk The model parameters representing the risk assessment of the model; Risk level classification is completed through the Softmax activation function: ; Where k represents the risk level; W cls,k represents the weight of the k-th risk level; S8403, Threat Trend Forecast: Combined with Shared Representation H shared and time series features F time and the association feature F assoc , that is, the threat trend prediction input feature H trend =[H shared , F time , F assoc ], predict and analyze the evolution trend of threats in time and space; Capturing trend changes through the time series modeling layer GRU: trend =GRU(H trend ), and predict the probability of threat events and generate trend graphs; S8404. The total loss function of joint learning combines the independent losses of each task and is defined as follows: L=λ event L event +λ risk Lrisk +λ trend L trend ; Among them, λ event , risk and λ trend They represent the task weights of abnormal event identification, risk assessment and trend analysis tasks respectively; L event , L risk and L trend They represent the losses of abnormal event identification, risk assessment, and trend analysis tasks respectively.

[0017] Preferably, the monitoring process of collecting data from five perspectives, namely, network traffic, malicious code, network performance, network routing and network log, is as follows: S91. In the initial stage of network security situation generation, multi-perspective monitoring and data collection captures all-round information about the network environment from multiple dimensions, taking network traffic monitoring, malicious code detection, network performance monitoring, network routing monitoring and network log monitoring as the entry points, and comprehensively acquires raw data covering network communications, application behaviors, device status, user activities and environmental dynamics; S92. In network traffic monitoring, deploy traffic collection tools to record the traffic patterns and communication details of data packets in real time, including source IP, destination IP, protocol type and packet size; S93. Malicious code detection relies on host-level and network-level monitoring tools to detect file system changes, abnormal process activities, and malicious behavior samples, and to assist in further analysis of malicious activities by collecting feature data; S94. Network performance monitoring uses a distributed monitoring platform to collect link status, delay time, packet loss rate and throughput, revealing the dynamic changes and bottlenecks of network performance; S95, Network routing monitoring collects routing table updates, topology changes and link anomalies through protocol monitoring tools to form a real-time view of network dynamic changes; S96. Network log monitoring focuses on the operation logs of systems and devices, and collects event records through centralized log management tools, including user login information, permission changes and security events.

[0018] Preferably, the cleaning process for cleaning the collected raw data is as follows: S101. Define a multi-factor weight calculation model, comprehensively consider the data time distribution, frequency characteristics and similarity characteristics, and dynamically generate a cleaning threshold. The formula is as follows: ; ; ; ; ; Where T represents the dynamic cleaning threshold; w t 、w f and w s They represent the weights of time distribution factor, frequency characteristic factor and similarity characteristic factor respectively, w t +w f +w s =1; f t (x) represents the time distribution factor, which measures the degree of deviation of the data point from the normal time interval; f f (x) represents the frequency characteristic factor, which evaluates the frequency deviation of the data point in the statistical distribution; f s (x) represents the similarity feature factor, which reflects the content similarity between the data point and its neighboring points; t x The timestamp representing the data point; Represents the timestamp mean of the same type of data; σ t Indicates the timestamp standard deviation of the same type of data; f x Indicates the frequency of occurrence of data points; f max Represents the maximum frequency in the entire data set; cos(θ x ) represents the vector similarity between a data point and its neighboring data; The feature vector representing the target data point x; The feature vector representing the neighboring data; and Represent the vector modulus of the target point and the modulus of the mean vector of the neighboring data points respectively; S102. Define cleaning rules: ; In the formula, x represents the original value of the data point; μ represents the mean of the same type of data; σ represents the standard deviation of the same type of data; S103, use adaptive strategy to adjust weights during cleaning: ; In the formula, Indicates the time distribution factor weight of the n+1th round; Δ t It represents the contribution gain of the time distribution factor to the cleaning result; α represents the adjustment rate, that is, the learning rate.

[0019] Compared with the prior art, the above technical solution of the present invention has the following beneficial technical effects: The present invention provides a network security situation generation method based on multi-perspective monitoring, aiming to achieve comprehensive perception of network security situation through multi-perspective data monitoring and collection, correlation analysis and model learning: (1) The present invention comprehensively collects data from five perspectives: network traffic monitoring, malicious code detection, network performance monitoring, network routing monitoring, and network log monitoring. It breaks through the limitations of traditional single-perspective monitoring and adopts a unified correlation identifier and time synchronization mechanism, combined with a logical layering method, to divide the collected data into network layer, application layer, device layer, user behavior layer, and environment layer. It deeply integrates multi-source data and performs cross-layer correlation analysis. This method effectively eliminates the problem of data islands, can comprehensively perceive the network security situation, capture potential attack links and hidden security threats, and provides strong support for accurate security event positioning and attack path identification; (2) Based on multi-perspective data after cross-layer correlation, the present invention extracts high-level feature vectors including basic information, high-level static features and dynamic features, and uses joint learning to simultaneously complete multiple network security tasks. By constructing a shared network to extract common features and combining dedicated branches for specific tasks, the present invention significantly improves the overall performance and collaborative capabilities of tasks such as abnormal event detection, risk assessment and classification, and threat trend prediction. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 A method flow chart of a network security situation generation method based on multi-view monitoring proposed by the present invention; Figure 2 Schematic diagram of the joint learning process of the joint learning model proposed in the present invention. DETAILED DESCRIPTION

[0021] Embodiment 1, as Figure 1~Figure 2 As shown, the present invention proposes a network security situation generation method based on multi-view monitoring, such as Figure 1 As shown, the specific implementation steps are as follows: S1, monitor and collect data from five perspectives: network traffic, malicious code, network performance, network routing and network logs; S2. Preprocessing and standardizing the collected data, preprocessing and standardizing the collected data, and cleaning the collected raw data based on a dynamic threshold adaptive multi-factor cleaning method; S3, logically stratify the processed raw data, including network layer, application layer, device layer, user behavior layer and environment layer; S4, integrating the data of the network layer, application layer, device layer, user behavior layer and environment layer through association identifiers and time windows to build a unified association relationship; S5. Perform time series modeling on the fused multi-view data to capture the dynamic characteristics of data changing over time; S6. Extract basic information, advanced features and dynamic features, including but not limited to time series features, graph features and behavior patterns, to provide input for model learning; S7. Use comprehensive features to build a joint learning model. In the model learning stage, a joint learning strategy of shared network and multi-task branches is adopted. Common features are extracted through the shared layer and combined with task-specific branches for detailed analysis to identify abnormal behaviors, detect unknown threats, and predict potential risks. S8. Generate network security situation based on statistical analysis and model prediction results. Combine the dynamic prediction results of model learning with the information generated by static analysis to form a network security situation. The generated situation information covers abnormal event identification and alarm, asset quantity and level distribution, vulnerability quantity and level distribution, risk assessment and level classification, and threat trend prediction.

[0022] In an optional embodiment, the implementation process of monitoring and collecting data from five perspectives, including network traffic, malicious code, network performance, network routing, and network logs, is as follows: S11. In the initial stage of network security situation generation, multi-perspective monitoring and data collection provides basic support for subsequent data analysis and security modeling by capturing all-round information about the network environment from multiple dimensions. It takes five perspectives, namely network traffic monitoring, malicious code detection, network performance monitoring, network routing monitoring and network log monitoring, as entry points to comprehensively obtain raw data covering network communications, application behaviors, device status, user activities and environmental dynamics. S12. In network traffic monitoring, deploy traffic collection tools (including but not limited to NetFlow or sFlow) to record the traffic patterns and communication details of data packets in real time, including source IP, destination IP, protocol type and packet size, to provide accurate basic data for identifying traffic anomalies and communication patterns; S13. Malicious code detection relies on host-level and network-level monitoring tools to detect file system changes, abnormal process activities, and malicious behavior samples, and assists in further analysis of malicious activities by collecting feature data (including but not limited to file hash values, behavior logs, and abnormal samples); S14. Network performance monitoring uses a distributed monitoring platform to collect link status, delay time, packet loss rate and throughput, revealing the dynamic changes and bottlenecks of network performance; S15. Network routing monitoring collects routing table updates, topology changes, and link anomalies through protocol monitoring tools (including but not limited to SNMP) to form a real-time view of network dynamic changes; S16. Network log monitoring focuses on the operation logs of systems and devices, and collects event records through centralized log management tools (including but not limited to ELK Stack), including user login information, permission changes and security events, to provide detailed basis for behavior auditing and anomaly detection.

[0023] In an optional embodiment, the preprocessing process of performing data preprocessing and standardization on the collected data is as follows: S21. Clean the collected raw data, including removing invalid fields, removing redundant records, and repairing missing values; For network traffic data, the cleaning process removes incomplete session records in the communication and corrects abnormal timestamps; For malicious code detection data, non-critical features with low relevance will be removed, including but not limited to log records of invalid file operations or non-abnormal processes; S22. Perform data format conversion, convert the data formats generated by different collection tools (including but not limited to JSON, CSV or binary log files) into a structured data table format, and perform field extraction and analysis on text logs; For example, extracting timestamps, event types, and user information from network logs for subsequent logical layer attribution and cross-layer correlation analysis; S23. Use normalization and standardization techniques to process numerical data (including but not limited to traffic size and delay time) so that it has a unified dimension among different monitoring sources. For time series data (including but not limited to link delay in network performance monitoring), synchronize the data of each monitoring source through time alignment and interpolation methods; S24. To improve analysis efficiency and expression ability, feature derivation is carried out for different types of data; For example, communication frequency and session duration can be extracted from traffic data, and behavioral feature vectors can be generated from malicious code data; Among them, derived features not only enhance the usability of data, but also provide higher-dimensional support for the extraction of basic information and advanced features in logical hierarchy.

[0024] In an optional embodiment, the specific implementation steps of the logical layering are as follows: S31. After data preprocessing is completed, the data from network traffic monitoring, malicious code detection, network performance monitoring, network routing monitoring and network log monitoring are divided into network layer, application layer, device layer, user behavior layer and environment layer according to attributes and analysis objectives: S32. Network layer management and communication activity-related data, including network traffic patterns, protocol behaviors, and routing table updates. Network layer data is derived from network traffic monitoring and network routing monitoring, covering the basic situation of network communications and reflecting the overall traffic characteristics and link operation status. S33, the application layer centrally stores data related to the application running status, including but not limited to server logs, API call records and performance indicators. Data from network performance monitoring and network log monitoring are classified into this layer to provide support for analyzing the stability and performance of application services; S34, the device layer manages data related to device operation status and security threats, including operation logs, communication records and internal alarm information of IoT devices. Data from malicious code detection belongs to this layer, including but not limited to device status changes and communication logs, which are used to monitor the operation security and potential threats of devices; S35, the user behavior layer stores user identity and operation behavior data, including but not limited to login information, operation logs, and permission change records; The source of this data is network log monitoring, especially system logs and activity logs that record user operation behaviors. By analyzing the user's identity, operation path, and behavior pattern, it supports the tracing of user activities and the detection of abnormal behaviors. S36, the environment layer covers external context information and environmental data, including but not limited to topology updates, device physical status and external threat intelligence (including but not limited to malicious IP lists). The source of the environment layer data is network routing monitoring and network log monitoring; Network routing monitoring provides topology status and link information, and network log monitoring provides intelligence data related to external threats. These data provide a supplementary perspective for the analysis of the global security situation and are used for a comprehensive assessment of the environmental status. S37. Based on this, data from different monitoring perspectives can be attributed to their respective corresponding layers, ensuring the semantic and functional clarity of the data and laying a good foundation for subsequent cross-layer associations.

[0025] In an optional embodiment, the implementation process of integrating the data of the network layer, application layer, device layer, user behavior layer and environment layer through the association identifier and time window is as follows: S41. After the data preprocessing stage, each data layer has a unified timestamp and identifier field. Through identifier alignment, records from different sources are initially logically associated based on the common identifiers in the data (including but not limited to IP addresses, user IDs, and device IDs); For example, the network layer IP address IP net Login IP address of the user behavior layer userAlignment, while the device ID (DeviceID device ) is the same as the device ID recorded in the application layer (DeviceID app ) matches, and builds a preliminary identifier mapping relationship through the consistency of field values, laying the foundation for further association; S42. After the identifiers are aligned, the time difference problem between data from different sources is solved through time window matching. To ensure the consistency of the dynamic event chain, a reasonable time window ΔT is set to associate the records whose time difference is within the tolerance range; For example, when the login event time T of the user behavior layer user and the traffic event time T of the network layer net , if |T user -T net |≤ΔT, then the two records are considered to be temporally related, and the matching in the time dimension enhances the dynamic consistency of the related data; S43, based on the identifier alignment and time window matching, further expand the deep association of inter-layer data, the specific implementation process is as follows: S4301. Establish association between the application layer and the user behavior layer: the log data of the application layer (including but not limited to API call records and application server logs) is matched with the login records and operation logs of the user behavior layer through the user ID (UserID) and session ID (SessionID); For example, when a user initiates an API call and performs a file operation after logging in, the scattered events are associated through the user ID and session information to generate a complete user operation path; S4302, between the device layer and the network layer, the association is achieved through the device ID and IP address: the running status of the device layer (including but not limited to device alarms and status changes) is matched with the device ID (Device ID) of the network layer traffic record (including but not limited to communication logs and abnormal traffic) to meet the following association conditions: DeviceID device =DeviceID net ; IP device =IP net ; Where, IP device Indicates the IP address of the device layer; DeviceID net Indicates the device ID of the network layer; DeviceID device Indicates the device ID of the device layer; Afterwards, the temporal consistency of the association is ensured through time window matching; For example, when a device is operating abnormally, if a surge in traffic on the relevant network interface is detected at the same time, it is determined that the abnormality may be caused by a network attack; S4303: The association between the network layer and the user behavior layer is established through the login IP address and network traffic record: the source IP (IP uesr ) and the source IP (IP net ) to match, the following conditions are met: IP net =IP uesr ; S4304, ensuring that user operations and network behaviors are associated in the time dimension through time window matching; For example, when a user logs in, a surge in abnormal traffic from the corresponding IP address is detected and marked as a potential threat; S4305, the environment perception layer provides context information for all layers, through the node identifier (NodeID) in the topology structure and the IP address (IP env ) Establish association with other layer data; For example, malicious IP (IP env ) directly matches the source IP (IP net ), the associated conditions are as follows: IP env =IP net ; S4306, through malicious identification (DeviceID env ) is associated with the device layer, and then matched to the login record of the user behavior layer: NodeID env ∈{DeviceID, IP, UserID}; Where, NodeID env Indicates the malicious node identifier; Based on this, the threat source can be quickly identified and located, and the scope of threat impact can be determined through contextual information; For example, when an external threat (IP env ) is matched with the network layer traffic and user operations, and it is confirmed that the attack is targeting the network interface of device A.

[0026] In an optional embodiment, time series modeling uses the result of cross-layer data association as input to generate a global event sequence with time dependency, providing basic data support for subsequent dynamic analysis and feature extraction, that is, extracting event records, organizing events in chronological order, and preprocessing the event sequence within the time window. The specific implementation process is as follows: S51, extracting event records from the result of cross-layer data association, and generating a time series in chronological order; The output of cross-layer data association contains a set of event records R assoc , each record r i Includes the timestamp T of the event i , comprehensive feature vector F i , and the associated identifier ID i : R assoc ={r1, r2, …, r n}, r i =(T i , F i , ID i ); Among them, the comprehensive feature vector F i =[f net , f app , f device , f user , f env ] is a multi-level feature generated in the cross-layer association process, according to the timestamp T i Sort a collection of records to generate a global time series: S={(T1,F1),(T2,F2),…,(T n , F n )}, T1≤T2≤…≤T n ; S52. Based on the generated time series, time series modeling is performed to extract dynamic characteristics. The time series is first divided into several subsequences according to a fixed time window ΔT. Each time window contains all events within its range. For each time window [T t , T t +ΔT], whose subsequence is defined as: S t ={(T i , F i )}|T t ≤T i <T t +ΔT; Among them, T t Indicates the start time of the time window, T t +ΔT is the end time, subsequence S t Contains all events that meet the conditions; S53, after the time window segmentation is completed, generate a comprehensive feature sequence X in each time window t , used for subsequent dynamic analysis and feature extraction, the representation of the feature sequence is as follows: X t=[F i , F j , …, F k ],i,j,k∈S t ; Among them, F i It is the comprehensive feature vector of events in the time window, arranged in the chronological order of the events.

[0027] In an optional embodiment, the process of extracting basic information, advanced features and dynamic features is as follows: S61. Extract multi-dimensional and multi-level features from the results of cross-layer data association and dynamic analysis to provide comprehensive and accurate data support for subsequent model training and situation generation; Feature extraction is divided into three parts: extracting basic information directly from the processed raw data; extracting time series features and behavior pattern features from the built time series module; extracting statistical features, association relationship features, graph features, context features and resource features from cross-layer data associations; The extracted features complement each other and jointly construct a complete feature space. The feature information extraction process is as follows: S6101, Basic Information F basic It is the basic features extracted directly from the raw data, describing the core information of network activities and entity status, including: The basic elements of network communication (including but not limited to source IP, destination IP, source port and destination port) are recorded as f ip_port ; Network protocol type (including but not limited to TCP, UDP, HTTP), recorded as f protocol ; The distribution of packet sizes f packet_size and the direction of traffic (upstream or downstream)f traffic_dir ; Based on this, we can get the feature F basic =[f ip_port , f protocol , f packet_size , f traffic_dir ]; S6102, time series feature F time It is a dynamic characteristic extracted from time series modeling, which describes the law of data change over time. Time series characteristics include: The peak flow time f time_peak ; The distribution of time intervals between events f time_interval ; The standard deviation of the operating frequency within the time window is f time_frequency ; Based on this, we can get the feature Ftime =[f time_peak , f time_interval , f time_frequency ]; S6103, Behavior Pattern Characteristics F behavior Focuses on the causal relationship between dynamic events. Its specific features include: The path length f in the attack link benavior_path ; Node Dependencyf benavior_dependency ; Key behavior trigger probability f benavior_trigger ; Based on this, we can get the feature F behavior =[f benavior_path , f benavior_dependency , f benavior_trigger ]; For example, from the attack link graph G attack =(V,E) The path length feature extracted reflects the complexity from the initial attack point to the target node, while the key behavior trigger probability can reveal which operations are most likely to cause security incidents; S6104, Statistical Features F stat Describing the distribution and aggregation characteristics of data provides insights into the global distribution of network activity. Specific characteristics include: The mean packet size f mean_packet ; The variance of the total flow rate f var_traffic ; The count of abnormal events within a specific time window f count_anomaly ; Based on this, we can get the feature F stat =[f mean_packet , f var_traffic , f count_anomaly ]; For example, a large variance in the total traffic volume may indicate a sudden increase in traffic volume during peak hours in the network, while the count of abnormal events directly reflects the frequency of potential threats in the network; S6105, association relationship feature F assoc It is used to reveal the association patterns between different data layers and help the model understand the complex interactions between different entities, including: Frequent patterns of user behavior and device state changes user_device ; Conditional probability f of API calls and traffic anomalies API_traffic ; The frequency of interaction between specific resources f resource_freq ; Based on this, we can get the feature F assoc =[fuser_device , f API_traffic , f resource_freq ]; For example, the frequent association between permission changes and abnormal API calls triggered after a user logs in may indicate potential permission abuse; S6106, graph feature F graph Based on the graph structure generated by cross-layer association, it describes the structured information of nodes and edges in the network. The specific features include: the degree of the node f graph_degree , the average clustering coefficient f of the graph graph-cluster , the distribution of the shortest paths between nodes f path_dist ; Among them, the above graph feature F graph The structural properties of the network topology are revealed. Nodes with higher degrees may represent core resources, while subgraphs with lower clustering coefficients may represent clusters of attack targets. Based on this, we can get the feature F graph =[f graph_degree , f graph-cluster , f path_dist ]; S6107, context feature F context From the environment layer, it provides a global perspective on the network background and external threats. These features can help the model quickly locate the threat source. Specific features include: Whether the device hits the external threat intelligence database threat_match ; The frequency of dynamic changes in network topology f topology ; Physical parameters of the equipment operating environment (including but not limited to temperature) environment ; Based on this, we can get the feature F context =[f threat_match , f topology , f environment ]; For example, by matching malicious IP addresses or detecting abnormal fluctuations in the device's operating environment; S6108, Resource Characteristics F resource It describes the resource distribution and status in the network, including the number of devices f resource_count , the priority level of the core device f resource_priority , and the current operating status of the resource (including but not limited to online or offline) resource_status ; For example, the priority level of key resources helps the model focus on high-value targets in threat detection, and abnormal changes in resource operation status may be a direct signal of attack behavior; Based on this combination, we get F resource =[fresource_count , f resource_priority , f resource_status ]; S62. Eliminate the dimensional differences between different features through feature normalization and encoding, and standardize the numerical features to a distribution with a mean of 0 and a standard deviation of 1, or normalize them to the interval [0,1]; Use one-hot encoding for categorical features and use TF-IDF for vectorization of text features. Finally, we get the comprehensive feature vector F=[F basic , F time , F behavior , F stat , F assoc , F graph , F context , F resource ]; Among them, the comprehensive feature vector F includes both dynamic features (including but not limited to time series features and behavior pattern features) and static features (including but not limited to statistical features and graph features), providing high-quality input support for model training and network security situation generation; S63. After feature extraction is completed, prepare training data and labels for the model learning stage. For tasks that require supervised learning, including but not limited to abnormal event identification, risk assessment and classification, and threat analysis and prediction, label y is a necessary input for model training, which defines the mapping relationship between input features and output results. Label generation is based on historical data, rule matching, or expert annotation to ensure that the training data has high-quality target values. 64. For the abnormal event identification and alarm task, the historical attack logs and the alarm records of the intrusion detection system (IDS) mark the samples for abnormal behavior. The label of the normal behavior sample is defined as y=0, and the label of the abnormal behavior sample is defined as y=1; The label of the risk assessment task is defined as the overall risk score R and the corresponding risk level y; The score label R is calculated based on the impact scope and severity of historical events, while the risk level y is discretized through predefined thresholds, including but not limited to low risk (y=1), medium risk (y=2), and high risk (y=3); S65. For threat analysis and prediction tasks, historical threat events and their time series changes provide prediction targets for samples, and the labels are defined as threat types y threat and the time series target value T trend ; Threat Type Label threat Classify and label based on historical threat types (including but not limited to DDoS attacks and data leaks), for example threat ∈{1,2,…,C}; Where C represents the number of threat categories; Time series target value T trend Based on the time series data of historical threat frequency, it is annotated through trend analysis algorithm; In addition, for tasks that do not require supervised learning, including but not limited to the number and level distribution of vulnerabilities and the number and level distribution of assets, statistical analysis and rule matching are used to directly generate results without explicit labels; For example, asset scanning tools automatically classify assets based on device type, sensitivity, and purpose, and vulnerability scanning tools classify vulnerabilities by CVSS score; S66. After the label generation is completed, the data is divided into training set, validation set and test set according to the task requirements to ensure the generalization ability of the model learning and the reliability of the results.

[0028] In an optional embodiment, if Figure 2 As shown in Figure 2, the construction process of the joint learning model is as follows: S71, input comprehensive feature vector F=[F basic , F time , F behavior , F stat , F assoc , F graph , F context , F resource ], in order to ensure the consistency of the data, the features are first standardized and encoded. The numerical features are mapped to the [0,1] interval through normalization operations, and the categorical features are represented by One-Hot Encoding: ; f i =[1,2,…,0] T ; in, represents the features after normalization; f i Represents the original vector of the i-th feature; After processing, all features are merged into the feature matrix X∈R N×p ; Among them, N is the number of samples, p is the feature dimension; S72, the shared representation layer is responsible for extracting task-independent general information from the input features and generating a shared representation H shared , the input feature matrix X is mapped to a high-dimensional feature through the fully connected layer: H (1) =σ(W (1) X+b (1) ); Among them, W(1) ∈R N×p represents the weight matrix, N represents the number of samples, and p represents the feature dimension; S73. In order to capture the interactive relationship between features, a multi-head attention mechanism is introduced to strengthen the correlation between features by calculating the attention weight. The output feature after the multi-attention mechanism is H shared ; The attention score a of each head ij The calculation is as follows: ; Among them, score(h i ,h j ) represents the feature h i and h j Similarity measure between ; The output of multi-head attention is: H (2) =Concat(head1,head2,…,head M )W0; Where M represents the number of attention heads; W0 represents the projection matrix; S74. Based on the shared representation layer, an independent branch network is designed for each task for modeling and optimization of specific tasks: S7401, abnormal event identification and alarm: input is shared to indicate H shared and time series features F time , combined with the behavioral pattern characteristics F behavior , that is, input feature: H event =[H shared , F time , F behavior ]; Then, a hybrid model is used to capture time dependency and causality, and the anomaly detection output is: y event =σ(W event H event +b event ); In the formula, y event ∈[0, 1] indicates whether the event is abnormal; W event and b event Model parameters that represent the model's abnormal event recognition and alarm; S7402, Risk Assessment and Grading: Using Shared Representation H shared and static features (statistical features F stat , contextual features F context , Resource Characteristics F resource) to perform risk scoring and classification, that is, the risk assessment input feature H risk =[H shared ,F stat ,F context ,F resource ], the shared representation input is: R=W risk H risk +b risk ; Where R represents the risk score; W risk and b risk The model parameters representing the risk assessment of the model; Risk level classification is completed through the Softmax activation function: ; Where k represents the risk level (high, medium, low); W cls,k represents the weight of the k-th risk level; S7403, Threat Trend Forecast: Combined with Shared Representation H shared and time series features F time and the association feature F assoc , that is, the threat trend prediction input feature H trend =[H shared , F time , F assoc ], predict and analyze the evolution trend of threats in time and space; Capture trend changes through the time series modeling layer GRU (Gated Recurrent Unit): trend =GRU(H trend ); Predict the probability of threat events and generate trend charts; S7404. The total loss function of joint learning combines the independent losses of each task and is defined as follows: L=λ event L event +λ risk L risk +λ trend L trend ; Among them, λ event , risk and λ trend They represent the task weights of abnormal event identification, risk assessment and trend analysis tasks respectively; L event , L risk and L trend They represent the losses of abnormal event identification, risk assessment, and trend analysis tasks respectively; Based on this: By sharing the common features of the network extraction task and combining it with the refined learning of task-specific branches, the joint learning framework achieves collaborative optimization among multiple tasks and effectively improves the comprehensive perception capability of complex network security situations.

[0029] In an optional embodiment, the generation and display process of the network security situation is as follows: S81. The generation of dynamic information relies on the results of model learning: through the output of the anomaly detection model, a security event alarm list is generated, including but not limited to event type, occurrence time, source IP, target IP and affected devices; To highlight the urgency of high-risk events, the priority level is marked in the alarm list, which is convenient for security managers to respond quickly. Combined with the results of the risk assessment model, the overall risk score and risk level distribution map of the network are generated. The risk score is mapped to the risk level of specific assets to highlight the high-risk assets in the network that need to be protected, and these assets are highlighted to support more accurate security policy formulation; S82. The generation of static information uses non-model methods for statistical analysis, covering the number and level distribution of assets, the number and level distribution of vulnerabilities, and threat trend analysis; Asset quantity and level distribution Based on the results of asset scanning tools, assets are divided into multiple categories (including but not limited to core devices, ordinary devices and low-priority devices) according to device type, purpose and sensitivity, providing the distribution of various types of assets in the network; The number and level distribution of vulnerabilities are combined with the results of vulnerability scanning tools, and are displayed by vulnerability severity (including but not limited to CVSS scores), providing the number and level distribution of vulnerabilities for each device; these results intuitively show possible security weaknesses in the network; Threat trend analysis is based on time series tools, combined with the frequency and type of security incidents, to generate attack trend charts, intuitively showing the changing trends of threats in different time periods, and helping to predict possible future threat directions; S83. Integration of multi-dimensional information realizes global situation display by organically combining dynamic and static information; Dynamically generated alarm events are combined with asset distribution information to form an alarm asset list, indicating the specific assets involved in each alarm event and the potential impact range; The risk level and vulnerability distribution data are superimposed to generate a threat level chart for high-risk assets, and to identify the devices and vulnerabilities that need to be repaired first; The threat trend analysis results are combined with the static information of asset status to generate a global network security situation map, providing managers with an overall security perspective; S84. Visual display of situation information adopts various forms to facilitate decision makers to quickly understand and analyze; Security event maps visually display the source and target of events from a geographical or topological perspective, helping to track threat paths; The risk distribution diagram shows the risk level distribution of assets and vulnerabilities in the form of bar charts and pie charts, clearly marking the priority; Trend analysis charts show the changes in threats over time in the form of line charts or heat maps, making it easier to identify threat growth points and high-incidence periods; In addition, visualization tools are used to support interactive query and detailed analysis functions, providing managers with more in-depth support; S85. The final situation report includes dynamic alarm events, static asset and vulnerability information, risk level assessment and trend analysis charts, forming a comprehensive and easy-to-understand network security situation report, providing a reliable basis for security operations and decision-making.

[0030] In an optional embodiment, the cleaning process of cleaning the collected raw data is as follows: S91. Define a multi-factor weight calculation model, comprehensively consider the data time distribution, frequency characteristics and similarity characteristics, and dynamically generate the cleaning threshold. The formula is as follows: ; ; ; ; ; Where T represents the dynamic cleaning threshold; w t 、w f and w s They represent the weights of time distribution factor, frequency characteristic factor and similarity characteristic factor respectively, w t +w f +w s =1; f t (x) represents the time distribution factor, which measures the degree of deviation of the data point from the normal time interval; f f (x) represents the frequency characteristic factor, which evaluates the frequency deviation of the data point in the statistical distribution; f s (x) represents the similarity feature factor, which reflects the content similarity between the data point and its neighboring points; t x The timestamp representing the data point; Represents the timestamp mean of the same type of data; σ t Indicates the timestamp standard deviation of the same type of data; f x Indicates the frequency of occurrence of data points; f max Represents the maximum frequency in the entire data set; cos(θ x ) represents the vector similarity between a data point and its neighboring data; The feature vector representing the target data point x; The feature vector representing the neighboring data; and Represent the vector modulus of the target point and the modulus of the mean vector of the neighboring data points respectively; S92. Define cleaning rules: ; In the formula, x represents the original value of the data point; μ represents the mean of the same type of data; σ represents the standard deviation of the same type of data; S93, use adaptive strategy to adjust weights during cleaning: ; In the formula, Indicates the time distribution factor weight of the n+1th round; Δ t It represents the contribution gain of the time distribution factor to the cleaning result; α represents the adjustment rate, that is, the learning rate.

[0031] The embodiments of the present invention are described in detail above with reference to the accompanying drawings, but the present invention is not limited thereto, and various changes can be made within the knowledge scope of technicians in the relevant technical field without departing from the purpose of the present invention.

Claims

1. A network security situation generation method based on multi-view monitoring, characterized in that: The specific implementation steps include the following: S1, monitor and collect data from five perspectives: network traffic, malicious code, network performance, network routing and network logs; S2. Preprocess and standardize the collected data, and clean the collected raw data based on a dynamic threshold adaptive multi-factor cleaning method; S3, logically stratify the processed raw data, including network layer, application layer, device layer, user behavior layer and environment layer; S4, integrating the data of the network layer, application layer, device layer, user behavior layer and environment layer through association identifiers and time windows to build a unified association relationship; S5. Perform time series modeling on the fused multi-view data to capture the dynamic characteristics of data changing over time; S6, extract basic information, advanced features and dynamic features to provide input for model learning; S7. Use comprehensive features to build a joint learning model. In the model learning stage, a joint learning strategy of shared network and multi-task branches is adopted. Common features are extracted through the shared layer and combined with task-specific branches for detailed analysis to identify abnormal behaviors, detect unknown threats, and predict potential risks. S8. Generate network security situation based on statistical analysis and model prediction results. Combine the dynamic prediction results of model learning with the information generated by static analysis to form a network security situation. The generated situation information covers abnormal event identification and alarm, asset quantity and level distribution, vulnerability quantity and level distribution, risk assessment and level classification, and threat trend prediction.

2. A method for generating network security situation based on multi-view monitoring according to claim 1, characterized in that: The specific implementation steps of logical stratification are as follows: S21. After data preprocessing is completed, the data from network traffic monitoring, malicious code detection, network performance monitoring, network routing monitoring and network log monitoring are divided into network layer, application layer, device layer, user behavior layer and environment layer according to attributes and analysis objectives: S22. Network layer management and communication activity-related data, including network traffic patterns, protocol behaviors, and routing table updates. Network layer data is derived from network traffic monitoring and network routing monitoring, reflecting overall traffic characteristics and link operation status. S23, the application layer centrally stores data related to the application running status, including data from network performance monitoring and network log monitoring; S24. The device layer manages data related to the device operation status and security threats, including the operation logs, communication records and internal alarm information of IoT devices, and classifies the data from malicious code detection into the device layer to monitor the operation security and potential threats of the device; S25, the user behavior layer stores user identity and operation behavior data; S26, the environment layer includes external context information and environment data, and the environment layer data comes from network routing monitoring and network log monitoring; S27. Assign the data from different monitoring perspectives to their respective corresponding levels.

3. A method for generating network security situation based on multi-view monitoring according to claim 1, characterized in that: The implementation process of integrating data from the network layer, application layer, device layer, user behavior layer, and environment layer through correlation identifiers and time windows is as follows: S31, aligning the data layers that have unified timestamp and identifier fields after the data preprocessing stage, and establishing preliminary logical associations between records from different sources based on the common identifiers in the data; Network layer IP address net Login IP address of the user behavior layer user Aligned, and the device ID of the device layer, that is, DeviceID device , and the device ID recorded in the application layer, i.e. DeviceID app , to match, and build a preliminary identifier mapping relationship through the consistency of field values; S32. After the identifiers are aligned, the time difference problem between data from different sources is solved by time window matching. To ensure the consistency of the dynamic event chain, a time window ΔT is set to associate records with time differences within the tolerance range. When the login event time T of the user behavior layer user and the traffic event time T of the network layer net , if |T user -T net |≤ΔT, then the two records are considered to be temporally associated; S33. Based on identifier alignment and time window matching, the depth of the inter-layer data is associated.

4. A method for generating network security situation based on multi-view monitoring according to claim 3, characterized in that: The association process of deep association of inter-layer data is as follows: S41, establishing an association between the application layer and the user behavior layer, the log data of the application layer is matched with the login record and operation log of the user behavior layer through the user ID, i.e., UserID, and the session ID, SessionID; S42. Establish an association between the device layer and the network layer through the device ID and the IP address: the running state of the device layer is matched with the device identifier of the flow record of the network layer through the device ID, i.e., DeviceID, and the following association conditions are met: DeviceID device =DeviceID net ; IP device =IP net ; Where, IP device Indicates the IP address of the device layer; DeviceID net Indicates the device ID of the network layer; DeviceID device Indicates the device ID of the device layer; Afterwards, the temporal consistency of the association is established through time window matching; S43, the association between the network layer and the user behavior layer is established through the login IP address and network traffic records. The source IP in the login event of the user behavior layer, i.e., IP uesr , and the source IP of the network layer traffic record, i.e. IP net , to match, the following conditions are met: IP net =IP uesr ; S44, establishing association between user operations and network behaviors in the time dimension through time window matching; S45, the environment perception layer provides context information for all layers through the node identifier in the topology structure, namely NodeID, and the IP address in the external threat intelligence, namely IP env , establish associations with other layer data; Among them, malicious IP, that is, IP env Directly match the source IP in the network layer traffic, that is, IP net , the associated conditions are as follows: IP env =IP net ; S46, through the malicious identification DeviceID env Associated with the device layer, and then matched to the login record of the user behavior layer: NodeID env ∈{DeviceID,IP,UserID}; Where, NodeID env Indicates the malicious node identifier; Based on this, the threat source can be quickly identified and located, and the scope of threat impact can be determined through contextual information.

5. The method for generating network security situation based on multi-view monitoring according to claim 1 is characterized in that: The construction process of time series modeling is as follows: S51, extracting event records from the result of cross-layer data association, and generating a time series in chronological order; The output of cross-layer data association contains a set of event records R assoc , each record r i Includes the timestamp T of the event i , comprehensive feature vector F i , and the associated identifier ID i : R assoc ={r1,r2,…,r n },r i =(T i ,F i ,ID i ); Among them, the comprehensive feature vector F i =[f net , f app , f device , f user , f env ] is a multi-level feature generated in the cross-layer association process, according to the timestamp T i Sort a collection of records to generate a global time series: S={(T1,F1),(T2,F2),…,(T n ,F n )},T1≤T2≤…≤T n ; S52. Based on the generated time series, a time series model is constructed to extract dynamic characteristics. The time series is first divided into several subsequences according to a fixed time window ΔT. Each time window contains all events within its range. For each time window [T t , T t +ΔT], whose subsequence is defined as: S t ={(T i ,F i )}|T t ≤T i <T t +ΔT; Among them, T t Indicates the start time of the time window, T t +ΔT is the end time, subsequence S t Contains all events that meet the conditions; S53, after the time window segmentation is completed, generate a comprehensive feature sequence X in each time window t , the representation of the feature sequence is as follows: X t =[F i ,F j ,…,F k ],i,j,k∈S t ; Among them, F i It is the comprehensive feature vector of events in the time window, arranged in the chronological order of the events.

6. The method for generating network security situation based on multi-view monitoring according to claim 1, characterized in that: The process of extracting basic information, advanced features and dynamic features is as follows: S61, extracting features from the results of cross-layer data association and dynamic analysis; Feature extraction is divided into three parts: extracting basic information directly from the processed raw data; extracting time series features and behavior pattern features from the built time series module; extracting statistical features, association relationship features, graph features, context features and resource features from cross-layer data associations to construct a comprehensive feature vector F; S62, after feature extraction is completed, prepare training data and labels; S63. For the abnormal event identification and alarm task, read the historical attack log and the alarm record of the intrusion detection system to identify whether there is abnormal behavior. The label of the normal behavior sample is defined as y=0, and the label of the abnormal behavior sample is defined as y=1; The label of the risk assessment task is defined as the overall risk score R and the corresponding risk level y; The score label R is calculated based on the impact and severity of historical events, and the risk level y is discretized by predefined thresholds, including: Low risk, i.e. y=1; Medium risk, i.e. y=2; High risk, i.e. y=3; S64, define a label, the label is defined as threat type y threat and the time series target value T trend ; Threat Type Label threat Classification and annotation based on historical threat types: y threat ∈{1,2,…,C}; Where C represents the number of threat categories; Time series target value T trend Based on the time series data of historical threat frequency, it is annotated through trend analysis algorithm; S65. After the label generation is completed, the data is divided into training set, validation set and test set according to task requirements.

7. A method for generating network security situation based on multi-view monitoring according to claim 6, characterized in that: The construction process of the comprehensive feature vector F is as follows: S71. Basic Information F basic , the basic features extracted directly from the raw data, including: The basic elements of network communication are recorded as f ip_port ; Network protocol type, recorded as f protocol ; The distribution of packet sizes f packet_size ; Flow directionf traffic_dir ; Based on this, we can get the feature F basic =[f ip_port , f protocol , f packet_size , f traffic_dir ]; S72, time series feature F time ,The dynamic characteristics extracted from time series modeling,time series features include: The peak flow time f time_peak ; The distribution of time intervals between events f time_interval ; The standard deviation f of the operating frequency within the time window time_frequency ; Based on this, we can get feature F time =[f time_peak , f time_interval , f time_frequency ]; S73, Behavior Pattern Characteristics F behavior , extracting the causal relationship between dynamic events, its specific features include: The path length f in the attack link benavior_path ; Node Dependencyf benavior_dependency ; Key behavior trigger probability f benavior_trigger ; Based on this, we can get the feature F behavior =[f benavior_path , f benavior_dependency , f benavior_trigger ]; S74, Statistical Features F stat , extract the distribution and aggregation characteristics of the data, including: The mean packet size f mean_packet ; The variance of the total flow rate f var_traffic ; The count of abnormal events within a specific time window f count_anomaly ; Based on this, we can get feature F stat =[f mean_packet , f var_traffic , f count_anomaly ]; S75, association relationship feature F assoc , that is, the association patterns between different data layers, including: Frequent patterns of user behavior and device state changes user_device ; Conditional probability f of API calls and traffic anomalies API_traffic ; The frequency of interaction between specific resources f resource_freq ; Based on this, we can get feature F assoc =[f user_device , f API_traffic , f resource_freq ]; S76, graph feature F graph , a graph structure generated based on cross-layer associations, with specific features including: The degree of the node f graph_degree ; The average clustering coefficient f of the graph graph-cluster ; Distribution of the shortest paths between nodes f path_dist ; Based on this, we can get feature F graph =[f graph_degree , f graph-cluster , f path_dist ]; S77, context feature F context , providing a global view of network context and external threats, with specific features including: Whether the device hits the external threat intelligence database threat_match ; The frequency of dynamic changes in network topology f topology ; Physical parameters of the equipment operating environment environment ; Based on this, we can get feature F context =[f threat_match , f topology , f environment ]; S78, Resource Characteristics F resource , extract the resource distribution and status in the network, including: Number of devices resource_count ; The priority level of the core device is f resource_priority ; The current running status of the resource resource_status ; Based on this combination, we get F resource =[f resource_count , f resource_priority , f resource_status ]; S79, standardize the numerical features, use one-hot encoding for categorical features, and use TF-IDF for vectorization of text features; Get the comprehensive feature vector F=[F basic , F time , F behavior , F stat , F assoc , F graph , F context , F resource ].

8. A method for generating network security situation based on multi-view monitoring according to claim 7, characterized in that: The construction process of the joint learning model is as follows: S81, input comprehensive feature vector F = [F basic , F time , F behavior , F stat , F assoc , F graph , F context , F resource ], the features are standardized and encoded, the numerical features are mapped to the [0,1] interval through normalization operations, and the categorical features are represented by one-hot encoding: ； f i =[1,2,…,0] T ； in, represents the features after normalization; f i Represents the original vector of the i-th feature; After processing, all features are merged into the feature matrix X∈R N×p ; Among them, N is the number of samples, p is the feature dimension; S82, the shared representation layer is responsible for extracting task-independent general information from the input features and generating a shared representation H shared , high-dimensional feature mapping is performed on the input feature matrix X through the fully connected layer: H (1) =σ(W (1) X+b (1) ); Among them, W (1) ∈R N×p represents the weight matrix, N represents the number of samples, and p represents the feature dimension; S83, introduce the multi-head attention mechanism, and strengthen the correlation between features by calculating the attention weight. The output feature after the multi-attention mechanism is H shared ; The attention score a of each head ij The calculation is as follows: ； Among them, score(h i ,h j ) represents the feature h i and h j Similarity measure between ; The output of multi-head attention is: H (2) =Concat(head1,head2,…,head M )W0; Where M represents the number of attention heads; W0 represents the projection matrix; S84. Based on the shared representation layer, an independent branch network is designed for each task to model and optimize specific tasks: S8401, abnormal event identification and alarm: input is shared to indicate H shared and time series features F time , combined with the behavioral pattern characteristics F behavior , that is, input feature: H event =[H shared , F time , F behavior ]; Then, a hybrid model is used to capture time dependency and causality, and the anomaly detection output is: y event =σ(W event H event +b event ); In the formula, y event Indicates whether the event is abnormal, y event ∈[0,1];W event and b event Model parameters that represent the model's abnormal event recognition and alarm; S8402, Risk Assessment and Classification: Using Shared Representation H shared , Statistical features F stat , contextual features F context and resource characteristics F resource Perform risk scoring and classification to obtain the risk assessment input feature H risk =[H shared ,F stat ,F context ,F resource ], the shared representation input is: R=W risk H risk +b risk ; Where R represents the risk score; W risk and b risk The model parameters representing the risk assessment of the model; Risk level classification is completed through the Softmax activation function: ； Where k represents the risk level; W cls,k represents the weight of the k-th risk level; S8403, Threat Trend Forecast: Combined with Shared Representation H shared and time series features F time and the association feature F assoc , that is, the threat trend prediction input feature H trend =[H shared , F time , F assoc ], predict and analyze the evolution trend of threats in time and space; Capturing trend changes through the time series modeling layer GRU: trend =GRU(H trend ), and predict the probability of threat events and generate trend graphs; S8404. The total loss function of joint learning combines the independent losses of each task and is defined as follows: L=λ event L event +λ risk L risk +λ trend L trend ; Among them, λ event , risk and λ trend They represent the task weights of abnormal event identification, risk assessment and trend analysis tasks respectively; L event , L risk and L trend They represent the losses of abnormal event identification, risk assessment, and trend analysis tasks respectively.

9. The method for generating network security situation based on multi-view monitoring according to claim 1, characterized in that: The monitoring process of collecting data from five perspectives, namely network traffic, malicious code, network performance, network routing and network logs, is as follows: S91. In the initial stage of network security situation generation, multi-perspective monitoring and data collection captures all-round information about the network environment from multiple dimensions, taking network traffic monitoring, malicious code detection, network performance monitoring, network routing monitoring and network log monitoring as the entry points, and comprehensively acquires raw data covering network communications, application behaviors, device status, user activities and environmental dynamics; S92. In network traffic monitoring, deploy traffic collection tools to record the traffic patterns and communication details of data packets in real time, including source IP, destination IP, protocol type and packet size; S93. Malicious code detection relies on host-level and network-level monitoring tools to detect file system changes, abnormal process activities, and malicious behavior samples, and assists in analyzing malicious activities by collecting feature data; S94. Network performance monitoring uses a distributed monitoring platform to collect link status, delay time, packet loss rate and throughput, revealing the dynamic changes and bottlenecks of network performance; S95, Network routing monitoring collects routing table updates, topology changes and link anomalies through protocol monitoring tools to form a real-time view of network dynamic changes; S96. Network log monitoring focuses on the operation logs of systems and devices, and collects event records through centralized log management tools, including user login information, permission changes and security events.

10. The method for generating network security situation based on multi-view monitoring according to claim 1, characterized in that: The cleaning process of the collected raw data is as follows: S101. Define a multi-factor weight calculation model, comprehensively consider the data time distribution, frequency characteristics and similarity characteristics, and dynamically generate a cleaning threshold. The formula is as follows: ； ； ； ； ； Where T represents the dynamic cleaning threshold; w t 、w f and w s They represent the weights of time distribution factor, frequency characteristic factor and similarity characteristic factor respectively, w t +w f +w s =1; f t (x) represents the time distribution factor, which measures the degree of deviation of the data point from the normal time interval; f f (x) represents the frequency characteristic factor, which evaluates the frequency deviation of the data point in the statistical distribution; f s (x) represents the similarity feature factor, which reflects the content similarity between the data point and its neighboring points; t x The timestamp representing the data point; Represents the timestamp mean of the same type of data; σ t Indicates the timestamp standard deviation of the same type of data; f x Indicates the frequency of occurrence of data points; f max Represents the maximum frequency in the entire data set; cos(θ x ) represents the vector similarity between a data point and its neighboring data; The feature vector representing the target data point x; Feature vector representing neighboring data; and Represent the vector modulus of the target point and the modulus of the mean vector of the neighboring data points respectively; S102. Define cleaning rules: ； In the formula, x represents the original value of the data point; μ represents the mean of the same type of data; σ represents the standard deviation of the same type of data; S103, use adaptive strategy to adjust weights during cleaning: ； In the formula, represents the time distribution factor weight of the n+1th round; Δ t It represents the contribution gain of the time distribution factor to the cleaning result; α represents the adjustment rate, that is, the learning rate.

Images