Network security situation awareness method and device for multi-source data fusion, equipment and medium

Abstract

The invention relates to a network security situation awareness method and device for multi-source data fusion, equipment and a medium, and the method comprises the steps: respectively collecting kernel logs and network flow data, and carrying out the standardization processing to generate a communication data set; constructing a dynamic process link map, defining a communication type, frequency and data volume, and updating a topological relation in real time; a sliding time window is adopted to count communication time sequence characteristics, and abnormal signals deviating from normal distribution are screened in combination with a time sequence analysis technology; training a robustness classifier model through an adversarial sample enhancement technology, fusing a graph neural network to analyze a dependency relationship between processes, and filtering a false alarm signal; and the hidden channel is accurately identified and alarm information is generated in combination with a dynamic similarity threshold and a threat intelligence gain coefficient, so that the problems of insufficient multi-source data fusion, high false alarm rate of a static rule base, failure in detection of weak signals of the hidden channel and the like in a traditional method are solved. And the real-time perception and response capability of APT attacks in a complex network environment is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and particularly relates to a network security situation awareness method, device, equipment and medium for multi-source data fusion. Background Art

[0002] With the rapid development of information technology, network security threats are evolving towards the direction of concealment and persistence. Attack means such as Advanced Persistent Threat (APT) achieve long-term latency by disguising legitimate communications and utilizing complex interactions between processes. Traditional detection methods based on a single data source have difficulty in coping with such threats. As the core of the active defense system, network security situation awareness technology needs to integrate multi-dimensional data such as system kernels and network traffic in real time, construct a global threat view to identify abnormal behaviors and predict potential risks. However, there are still significant bottlenecks in the existing methods in aspects such as the deep fusion of multi-source heterogeneous data and the modeling of dynamic attack behaviors.

[0003] The current mainstream network security situation awareness solutions mainly rely on static rule libraries or offline analysis of a single data source, and it is difficult to adapt to the dynamic changes in inter-process communication in complex network environments. For example, the fragmentation of kernel logs and network traffic data makes it difficult to effectively detect the covert channels constructed by attackers through cross-layer communication; the anomaly detection model based on fixed thresholds cannot capture the temporal evolution characteristics of attack behaviors, and the problems of false positives and false negatives are prominent. In addition, the existing technology lacks continuous tracking of the context association of communication links, resulting in weak anomaly signals of covert channels being easily submerged by massive data. Summary of the Invention

[0004] Based on this, the purpose of the present invention is to provide a network security situation awareness method for multi-source data fusion that can dynamically fuse multi-source data, update the network topology in real time, and accurately identify covert communication links.

[0005] The purpose of the present invention is achieved by the following solutions:

[0006] In the first aspect, the present invention provides a network security situation awareness method for multi-source data fusion, including the following steps:

[0007] S1: Perform multi-source data collection and standardization processing on the kernel logs and network traffic of the system to be detected, extract function call sequences, pipe communication metadata, and network socket connection data, and generate a communication data set;

[0008] S2: Construct a dynamic process link graph for the communication data set, define edge attributes with processes as nodes and communication links as edges, and generate a directed graph model. The directed graph model is used to represent the topological relationship of the communication type, frequency, and data volume between processes;

[0009] S3: Based on the sliding time window statistics and time series analysis techniques, extract the time series features of the directed graph model and conduct preliminary anomaly screening. Calculate the average communication frequency, the variance of data volume distribution, and the directional features of each edge to generate the first anomaly signal set, which is used to identify the potential threat links deviating from the normal communication mode.

[0010] S4: Conduct multi-model fusion and denoising filtering on the first anomaly signal set. Identify false alarm signals through a support vector machine classifier and dynamically adjust the weights using an incremental graph update algorithm to generate the second anomaly signal set.

[0011] S5: Conduct covert channel pattern matching on the second anomaly signal set. Calculate the similarity between the feature vectors and the preset covert channel patterns to generate a covert channel set, which is used to output threat warning information including process identifiers, communication types, and timestamps.

[0012] In one embodiment, step S1 of the network security situation awareness method based on multi-source data fusion provided by the present invention specifically includes the following steps:

[0013] S11: Process the kernel logs of the system to be detected based on eBPF tools, and collect function call sequences, pipe communication metadata, and local socket connection data in real time to generate inter-process communication data.

[0014] S12: Process the network traffic of the system to be detected through TCPDump network traffic parsing technology, capture network socket communication data, and parse the protocol headers and payload lengths to generate network communication data.

[0015] S13: Process the inter-process communication data and network communication data based on data format standardization technology, unify the timestamps and data volume units, and generate a communication data set.

[0016] In one embodiment, step S2 of the network security situation awareness method based on multi-source data fusion provided by the present invention specifically includes the following steps:

[0017] S21: Process the communication data set through graph structure modeling technology, define the process node attributes and the communication link edge attributes to generate an initial directed graph model.

[0018] S22: Process the initial directed graph model, traverse the process dependency relationships, and calculate the in-degree and out-degree of the nodes to generate a dependency relationship graph.

[0019] S23: Process the dependency relationship graph through dynamic weight update technology, adjust the edge weights according to the communication frequency and data volume, and generate a directed graph model.

[0020] In one embodiment, S3 of a network security situation awareness method with multi-source data fusion provided by the present invention specifically includes the following steps:

[0021] S31: Process the directed graph model through the sliding time window technique, and statistically calculate the average communication frequency and the variance of the data volume at preset time intervals to generate a time series feature sequence;

[0022] S32: Process the time series feature sequence through the DBSCAN clustering algorithm, screen outlier feature vectors according to the density distribution, and generate an initial abnormal signal set; <L

[0023] S33: Process the initial abnormal signal set through the threshold filtering technique, calculate the abnormal score threshold, and remove the signals in the initial abnormal signal set that are lower than the abnormal score threshold to generate a first abnormal signal set. The calculation formula for the abnormal score threshold is:

[0024]

[0025] Where P score is the abnormal score threshold, α, β, and γ are weight coefficients, and α + β + γ = 1, F is the average communication frequency of the initial abnormal signal set, μ F and σ F are respectively the mean and standard deviation of the historical normal communication frequency, D is the data volume variance, μ D and σ D are respectively the mean and standard deviation of the historical normal data volume variance, Dir is the directional feature, μ Dir and σ Dir are respectively the mean and standard deviation of the historical normal directional feature.

[0026] In one embodiment, S4 of a network security situation awareness method with multi-source data fusion provided by the present invention specifically includes the following steps:

[0027] S41: Process the normal communication mode data set through the adversarial sample enhancement technique to generate a training sample set containing adversarial noise, and train a support vector machine classifier through the transfer learning algorithm to generate a robust classifier model;

[0028] S42: Process the first abnormal signal set through the context-aware classification technique, combine the robust classifier model and the graph neural network to analyze the topological dependence relationship between processes, and filter out the false alarm signals matching the normal mode to generate an intermediate abnormal signal set;

[0029] S43: Process the intermediate abnormal signal set through the spatio-temporal graph convolution technique, reconstruct the spectral edge weights based on the time series features of the communication link, and generate a second abnormal signal set.

[0030] In one embodiment, S43 of a network security situation awareness method based on multi-source data fusion provided by the present invention specifically includes the following steps:

[0031] S431: Process the intermediate abnormal signal set through the node weight attenuation algorithm to reduce the graph influence of inactive nodes and generate an updated weight graph;

[0032] S432: Process the updated weight graph, fuse the historical attack chain pattern recognition abnormal edge attribute associations, highlight the visual markers of high-frequency abnormal links, and generate a strengthened marker graph;

[0033] S433: Process the strengthened marker graph through a spatio-temporal probability graph model, model the time dependence and spatial propagation probability of communication links, and generate a second abnormal signal set.

[0034] In one embodiment, S5 of a network security situation awareness method based on multi-source data fusion provided by the present invention specifically includes the following steps:

[0035] S51: Process the second abnormal signal set through feature normalization technology to eliminate the dimension difference and generate a standardized feature vector set;

[0036] S52: Process the standardized feature vector set through the cosine similarity algorithm, match the preset covert channel pattern, and generate a similarity score set;

[0037] S53: Process the similarity score set through dynamic threshold determination technology, calculate the dynamic similarity threshold and screen the communication links in the similarity score set that exceed the dynamic similarity threshold, and extract the process identifier, communication type, and timestamp from the communication dataset based on the unique identifier of the screened communication links to generate a covert channel set. The calculation formula of the dynamic similarity threshold is:

[0038]

[0039] Where, T threshold (t) is the dynamic similarity threshold, T base is the initial similarity threshold obtained from historical attack data statistics, λ is the threat intelligence gain coefficient, k is the time decay factor, t is the current time, t0 is the initial attack detection time, and e is the natural constant.

[0040] In a second aspect, the present invention provides a network security situation awareness device based on multi-source data fusion, and the device is configured with the following modules:

[0041] A data acquisition and processing module, which is used to perform multi-source data acquisition and standardization processing on the kernel logs and network traffic of the system to be detected, extract function call sequences, pipeline communication metadata, and network socket connection data, and generate a communication dataset;

[0042] A dynamic graph construction module, which is used to construct a dynamic process link graph for a communication data set, define edge attributes with processes as nodes and communication links as edges, generate a directed graph model, and the directed graph model is used to represent the topological relationship of the communication type, frequency, and data volume between processes;

[0043] An abnormal link preliminary screening module, which is used to extract time series features and perform preliminary abnormal screening on the directed graph model based on the sliding time window statistics and time series analysis technology, calculate the average communication frequency, data volume distribution variance, and directional features of each edge, and generate a first abnormal signal set, and the first abnormal signal set is used to identify potential threat links that deviate from the normal communication mode;

[0044] An abnormal signal enhancement module, which is used to perform multi-model fusion and denoising filtering on the first abnormal signal set, identify false alarm signals through a support vector machine classifier, and dynamically adjust weights using an incremental graph update algorithm to generate a second abnormal signal set;

[0045] A covert channel screening module, which is used to perform covert channel pattern matching on the second abnormal signal set, calculate the similarity between the feature vector and the preset covert channel pattern, and generate a covert channel set, and the covert channel set is used to output threat alarm information including process identification, communication type, and timestamp.

[0046] In a third aspect, the present application provides a computer device, including a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements any one of the above-mentioned network security situation awareness methods for multi-source data fusion.

[0047] In a fourth aspect, the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements any one of the above-mentioned network security situation awareness methods for multi-source data fusion.

[0048] In summary, the network security situation awareness method based on multi-source data fusion provided by the present invention systematically integrates multi-source heterogeneous data such as kernel logs and network traffic, breaks through the limitations of traditional single data source detection, and can effectively solve technical bottlenecks such as difficult recognition of weak signals in covert channels, insufficient modeling of dynamic attack behaviors, and high false alarm rates. First, based on the deep fusion of kernel-level process communication data and network traffic data, covering all-dimensional attack link features such as function calls, pipe communications, and socket connections, a dynamically updated process interaction graph is constructed, thereby overcoming the defect that traditional static models cannot track the real-time evolution of attack links; second, through time series feature analysis and multi-model collaborative filtering mechanisms, abnormal deviation patterns of communication frequency, data volume distribution, and directional features are accurately extracted within a sliding time window. Combining unsupervised clustering and supervised classification techniques, the false alarm interference caused by normal business fluctuations is significantly reduced; in addition, an incremental graph update algorithm and a dynamic threshold determination mechanism are introduced to optimize the abnormal link weight in real time and adaptively adjust the threat determination conditions, effectively coping with the covert penetration behaviors implemented by attackers through means such as frequently switching communication nodes and encrypting traffic, and finally outputting accurate alarm information including process identifiers, communication types, and timestamps. Compared with the prior art, the present invention can realize the full process dynamicization and intelligence from data collection, feature analysis to threat determination, thereby improving the perception accuracy and response timeliness of covert threats in complex network environments, and providing reliable technical support for the active defense against advanced persistent threats.

[0049] For better understanding and implementation, the present invention will be described in detail below with reference to the accompanying drawings. Description of the Drawings

[0050] Figure 1 It is a schematic flowchart of a network security situation awareness method based on multi-source data fusion provided by an embodiment of the present application;

[0051] Figure 2 It is a schematic flowchart of generating a first abnormal data set provided by an embodiment of the present application;

[0052] Figure 3 It is a schematic flowchart of generating a second abnormal data set provided by an embodiment of the present application;

[0053] Figure 4 It is a schematic structural diagram of a network security situation awareness device based on multi-source data fusion provided by another embodiment of the present application. Detailed Embodiments

[0054] To facilitate the understanding of the present invention, the present invention will be described more comprehensively below with reference to the relevant drawings. Preferred embodiments of the present invention are shown in the drawings. However, the present invention can be implemented in many different forms and is not limited to the embodiments described herein. On the contrary, these embodiments are provided to make the understanding of the disclosure of the invention more thorough and comprehensive.

[0055] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the technical field to which this invention belongs. The terms used in the description of the invention herein are for the purpose of describing particular embodiments only and are not intended to limit the invention. The term "and / or" used herein includes any and all combinations of one or more of the associated listed items.

[0056] In one embodiment, as Figure 1 shown, a network security situation awareness method for multi-source data fusion is provided. In this embodiment, the method is exemplified by being applied to a terminal. It can be understood that the method can also be applied to a server and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0057] S1: Perform multi-source data collection and standardization processing on the kernel logs and network traffic of the system to be detected, extract function call sequences, pipe communication metadata, and network socket connection data, and generate a communication data set.

[0058] Specifically, the system deeply monitors the operation behavior at the kernel level of the system to be detected and accurately extracts function call sequences. These function call sequences detail the interaction logic and execution process between internal modules of the system, thus completely restoring the behavior track of the process at the kernel level, accurately capturing key details such as the occurrence time, call parameters, and return values of each system call event, ensuring comprehensive monitoring of kernel activities, and further being able to provide key clues for subsequent analysis to help identify potential malicious operation patterns. At the same time, the system focuses on the collection of pipe communication metadata, comprehensively covering relevant information on data transmission between processes through pipes, including key parameters such as data flow direction, transmission rate, and timestamps of pipe creation and destruction. These metadata can clearly depict the cooperation relationship between processes and provide strong support for identifying abnormal data exchange behaviors.

[0059] In addition, the system collects network socket connection data to comprehensively obtain detailed information at the network communication level, such as source address, destination address, port number, connection establishment and disconnection times, transmission protocol type, and packet size distribution. These data are the key basis for analyzing network attack behaviors. After collecting these different types of data, the system can use a standardized processing algorithm to normalize the data, unify the data format, and ensure the consistency and comparability of the data. For example, perform a unified format conversion on timestamps and convert the packet sizes of different protocol types into a unified measurement unit. Through this series of standardization operations, the system finally generates a communication dataset with a rigorous structure and complete content, providing a solid data foundation for subsequent analysis steps and ensuring that the entire situation awareness process can be carried out accurately and efficiently.

[0060] S2: Construct a dynamic process link map for the communication dataset, define edge attributes with processes as nodes and communication links as edges, and generate a directed graph model. The directed graph model is used to represent the topological relationships of inter-process communication types, frequencies, and data volumes.

[0061] Specifically, the system uses each process in the system as the basic building block of the map, defines each process as a node in the map. These nodes carry comprehensive attribute information of the process, including but not limited to process name, process ID, owner user, start time, occupied resources, etc., to ensure a complete description of the characteristics of the process itself. For the communication relationships between processes, they are accurately modeled in the map in the form of directed edges. Each directed edge represents a communication interaction behavior between processes, pointing from the data-sending process to the data-receiving process, clearly indicating the directionality of the communication and the main relationship between the initiator and the receiver.

[0062] The system assigns rich attribute characteristics to each edge. Among them, the communication type can distinguish the specific mechanism adopted for inter-process communication, such as shared memory communication, message queue communication, socket communication, etc. Different communication types reflect different ways and characteristics of data exchange between processes; the communication frequency attribute counts the number of communication behaviors that occur on this communication link within a specific time interval. Through high-frequency or low-frequency communication phenomena, the degree of tightness of cooperation or potential abnormal interaction patterns between processes can be observed; the data transmission volume attribute can record the data size involved in each communication. By analyzing the data volume, abnormal fluctuations in data traffic can be discovered. For example, sudden large-scale data transmission may imply potential data leakage or malicious communication behaviors.

[0063] Specifically, the system continuously adjusts the structure and edge attributes of the process link graph by real-time monitoring and dynamically updating the information in the communication dataset. When new communication behaviors occur, the system can quickly add new nodes or edges to the graph, or update the attribute values of existing edges, ensuring that the graph can reflect the latest topological relationship of inter-process communication within the system in real time. This dynamically constructed process link graph not only intuitively presents the complex inter-process communication network within the system, but also provides in-depth structured data support for subsequent situation awareness analysis through the detailed characterization of edge attributes, enabling the system to deeply understand the interaction patterns between processes and their potential security risk associations from multiple dimensions such as the type, frequency, and data volume of communication behaviors, providing a solid foundation for identifying hidden threats and abnormal communications.

[0064] S3: Extract temporal features and perform initial anomaly screening on the directed graph model based on sliding time window statistics and temporal analysis techniques, calculate the mean communication frequency, data volume distribution variance, and directional features of each edge, and generate a first anomaly signal set, which is used to identify potential threat links deviating from the normal communication mode.

[0065] Specifically, the sliding time window statistics technique divides the entire monitoring time axis into multiple continuous window units with a certain degree of overlap. The window size can be flexibly set according to the actual application scenario and the requirement for real-time performance. For example, in a financial trading system with extremely high real-time requirements, the window size can be set to a few minutes to quickly capture communication changes; while in a big data analysis system with higher requirements for data integrity, the window size can be appropriately extended to several hours. Within each sliding time window, the system calculates the mean communication frequency for each edge in the directed graph. This indicator can intuitively reflect whether the communication activity exceeds the normal range. For example, under normal circumstances, the communication frequency between two processes may be maintained at about 10 times per minute. If the mean communication frequency suddenly soars to 100 times per minute within a certain time window, this may indicate potential abnormal communication behaviors. At the same time, the system analyzes the variance of the data volume distribution to evaluate the stability of data transmission. An overly large data volume variance may imply abnormal large data packet transmission or frequent small data packet transmission, which may be signs that attackers are trying to transmit malicious data through hidden channels. For example, in normal business communications, the packet sizes may be relatively uniform, while attackers, in order to avoid detection, may split malicious data into a large number of tiny data packets for transmission, or send oversized data packets containing malicious payloads.

[0066] The system also calculates the directional characteristics of communications, closely monitoring whether the direction of communications conforms to normal business logic. Under normal circumstances, some processes may only act as data senders, while other processes mainly serve as data receivers. If reverse communications occur between processes, or a process that usually does not send data suddenly starts to send a large amount of data, these may all constitute signs of abnormal communications. Through the comprehensive calculation and analysis of these timing characteristics, the system can initially screen out those links that deviate from the normal communication mode, forming a first set of abnormal signals. This process is like conducting preliminary screening and filtering in a vast amount of data, separating potential threat signals from numerous normal communications, providing key objects of concern for subsequent in-depth analysis, and effectively improving the monitoring efficiency and accuracy of the entire situation awareness system.

[0067] S4: Perform multi-model fusion and denoising filtering on the first set of abnormal signals, identify false alarm signals through a support vector machine classifier, and dynamically adjust the weights using an incremental graph update algorithm to generate a second set of abnormal signals.

[0068] Specifically, the support vector machine classifier is trained based on a large number of labeled normal and abnormal communication samples, covering a variety of complex network security scenarios and attack types, thus possessing powerful pattern recognition capabilities. When the first set of abnormal signals is input into the support vector machine classifier, the system conducts a meticulous classification analysis of each abnormal signal according to the pre-learned decision rules, identifying those signals that may be false alarms. False alarm signals usually refer to situations where they actually belong to normal communications but are misjudged as abnormal due to certain special conditions or noise interference during the initial screening. For example, in the case of a sudden burst of network traffic, some normal business processes may exhibit short-term high-frequency communications, which may be misjudged as abnormal during the initial detection. Through the accurate identification of the support vector machine classifier, these false alarm signals are effectively removed.

[0069] While removing false alarm signals, the system runs the incremental graph update algorithm in parallel to dynamically adjust the dynamic process link graph in real time. According to the new data and detection results, this algorithm updates key parameters such as the weights of each edge in the graph in real time to accurately reflect the latest changes in the system communication relationship. For example, when it is found that a certain communication link exhibits abnormal characteristics in multiple consecutive time windows, the system will correspondingly increase the weight of this edge, making it receive more attention in subsequent analysis; conversely, if a certain link is confirmed as a false alarm, its weight will be reduced to reduce the occupation of system resources. Through this collaborative working mechanism of multi-model fusion and denoising filtering, the system can effectively remove most false alarm signals, retain those abnormal signals that are more likely to be real threats, and generate a second set of abnormal signals. This process is like a secondary screening and purification of the initially selected potential threat signals, ensuring that the finally retained abnormal signals have higher credibility and threat level, thus providing more accurate and reliable input for subsequent covert channel detection and significantly improving the effectiveness and accuracy of the entire situation awareness system.

[0070] S5: Perform covert channel pattern matching on the second set of abnormal signals, calculate the similarity between the feature vectors and the preset covert channel patterns, and generate a set of covert channels, which is used to output threat warning information including process identifiers, communication types, and timestamps.

[0071] Specifically, the system pre-stores a set of covert channel pattern feature vectors that have been strictly defined and feature-extracted. These patterns cover common covert communication means, including but not limited to various typical features such as protocol field tampering, packet payload covert encoding, cross-process micro-data flow penetration, and covert communication based on time interval. Each covert channel pattern has been carefully designed and verified to ensure that it can accurately reflect the internal characteristics of a specific covert communication behavior. For example, the protocol field tampering pattern will specifically define which fields are vulnerable to being exploited by attackers for information hiding, the range and variation rules of the tampered field values, etc.; the packet payload covert encoding pattern will cover common encoding algorithm features and data distribution patterns, etc.

[0072] Specifically, for each abnormal signal in the second abnormal signal set, the system extracts its corresponding feature vector, which contains detailed information in multiple dimensions such as process identifier, communication type, timestamp, communication frequency change trend, and data volume distribution characteristics; and calculates the similarity between the extracted feature vector and the preset feature vector of the covert channel pattern one by one. Preferably, the similarity calculation can adopt appropriate algorithm formulas such as cosine similarity and Euclidean distance, and determine whether the matching is successful according to the set similarity threshold. If the calculated similarity value exceeds the threshold, the system determines that there is a suspicion of a covert channel in the communication link corresponding to the abnormal signal and includes it in the covert channel set. Finally, based on each member in the covert channel set, the system generates threat warning information containing key information such as process identifier, communication type, and timestamp, and can send an alarm to the security administrator in a timely manner through a visualization interface or an alarm notification module, etc., to achieve real-time, accurate perception and early warning of the network security situation, and provide timely and accurate basis for subsequent emergency response handling.

[0073] In summary, the network security situation awareness method based on multi-source data fusion provided by the present invention breaks through the limitations of traditional single data source detection by systematically integrating multi-source heterogeneous data such as kernel logs and network traffic, and can effectively solve technical bottlenecks such as difficult recognition of weak signals of covert channels, insufficient modeling of dynamic attack behaviors, and high false alarm rates. First, based on the deep fusion of kernel-level process communication data and network traffic data, covering all-dimensional attack link characteristics such as function calls, pipe communications, and socket connections, a dynamically updated process interaction graph is constructed, thus overcoming the defect that traditional static models cannot track the real-time evolution of attack links; secondly, through time series feature analysis and multi-model collaborative filtering mechanism, abnormal deviation patterns of communication frequency, data volume distribution, and directional characteristics are accurately extracted within a sliding time window, and combined with unsupervised clustering and supervised classification technologies, the false alarm interference caused by normal business fluctuations is significantly reduced; in addition, an incremental graph update algorithm and a dynamic threshold determination mechanism are introduced to optimize the abnormal link weight in real time and adaptively adjust the threat determination conditions, effectively coping with the covert penetration behaviors implemented by attackers through means such as frequently switching communication nodes and encrypting traffic, and finally outputting accurate warning information containing process identifier, communication type, and timestamp. Compared with the prior art, the present invention can realize the full-process dynamicization and intelligence from data collection, feature analysis to threat determination, thereby improving the perception accuracy and response timeliness of covert threats in complex network environments, and providing reliable technical support for the active defense of advanced persistent threats.

[0074] In one embodiment, step S1 of the network security situation awareness method based on multi-source data fusion provided by the present invention specifically includes the following steps:

[0075] S11: Process the kernel logs of the system to be detected based on eBPF tools, collect function call sequences, pipe communication metadata, and local socket connection data in real time, and generate inter-process communication data.

[0076] Specifically, eBPF (Extended Berkeley Packet Filter) is a Linux kernel technology that allows developers to run custom programs in the kernel and can efficiently capture and respond to various kernel events. The system is attached to hook points such as kernel tracepoints or kprobes in the kernel through eBPF programs to collect function call sequences, pipe communication metadata, and local socket connection data in real time. These eBPF programs run in the kernel and can capture key events such as system calls and process information with extremely low performance overhead. Specifically, the system uses eBPF programs to accurately capture the chain and order of inter-process function calls, and details such as the occurrence time, call parameters, and return values of each system call are recorded in detail to ensure comprehensive monitoring of kernel activities.

[0077] At the same time, the system deeply analyzes pipe communication through eBPF programs, extracts metadata such as the process identifiers of both communication parties, pipe types, and data transfer volumes, and comprehensively records the complete process of data exchange between processes through pipes. For local socket connection data, the system also uses eBPF programs to accurately capture key information such as source / destination process identifiers, socket types, and transport protocols to ensure comprehensive monitoring of local network communication. The collected data is output to the kernel's log buffer through functions such as BPF_trace_printk, and user-space programs can read this buffer and store the data in a log file to generate detailed inter-process communication data. These data cover the communication behaviors, data flow directions, and key system call information between processes, providing rich kernel-level details for subsequent network security situation awareness analysis.

[0078] S12: Process the network traffic of the system to be detected through TCPDump network traffic parsing technology, capture network socket communication data, and parse protocol headers and payload lengths to generate network communication data.

[0079] Specifically, TCPDump is a widely used tool for network packet capture and analysis. It can capture network packets in real time as they enter and leave a network interface and perform in-depth parsing on them. The system captures network socket communication data through TCPDump, including key information such as source IP address, destination IP address, port number, and transport protocol type, and further parses the protocol header and payload length. In terms of protocol header parsing, the system can identify and extract key fields of transport layer and application layer protocols, such as TCP sequence number, acknowledgment number, and flags, UDP port number and length, HTTP request method and status code, etc., thus revealing the detailed information of transport layer and application layer protocols of the packets.

[0080] For payload length analysis, the system can evaluate the size of the payload of each packet, count the data transmission volume per unit time, and analyze the distribution characteristics of data traffic. This is of great significance for identifying abnormal traffic patterns, such as sudden large-scale data transmission or frequent small packet transmissions. The parsed data is integrated into network communication data, which contains communication details and traffic characteristics at the network layer, providing a comprehensive network-level perspective for subsequent network security analysis to ensure timely detection of potential network threats.

[0081] S13: Process the inter-process communication data and network communication data based on data format standardization technology, unify the timestamps and data volume units, and generate a communication data set.

[0082] Specifically, in terms of timestamp standardization, the system uniformly converts timestamps from different data sources into a standard time format, such as the ISO 8601 format (YYYY-MM-DDTHH:MM:SS.sssZ), eliminating data inconsistency problems caused by time format differences. For timestamp processing, considering the unified conversion of time zones, the system ensures that all time information is based on Coordinated Universal Time (UTC) to avoid time series confusion caused by time zone differences. In terms of data volume unit standardization, the system uniformly converts units such as bytes, KB, and MB that may exist in different data sources into byte units for accurate data volume comparison and analysis. The system also standardizes other fields of the data, such as unifying the format of process identifiers, converting process IDs in different systems into a unified string representation; standardizing the representation of network addresses, converting IPv4 and IPv6 addresses into the standard dotted decimal or colon-separated hexadecimal format.

[0083] In addition, the system also normalizes the semantics of the data to ensure the consistency of field names and data types. For example, it unifies "source_port" and "src_port" into "source_port", and clearly differentiates between the port number of integer type and the protocol name of string type. After these standardization steps, the system finally generates a structured communication data set, which integrates the key information of kernel logs and network traffic, eliminates the format differences between data sources, and provides a high-quality and standardized data foundation for subsequent network security situation awareness analysis. These standardized data will be further used to construct a dynamic process link map, extract time series features and detect anomalies, ensuring that the system can efficiently and accurately identify potential network security threats.

[0084] In one embodiment, step S2 of the network security situation awareness method based on multi-source data fusion provided by the present invention specifically includes the following steps:

[0085] S21: Process the communication data set through graph structure modeling technology, define the process node attributes and the communication link edge attributes, and generate an initial directed graph model.

[0086] Specifically, the system first comprehensively scans the communication data set, identifies and extracts the process identification information therein, and creates a node for each unique process identification. These nodes represent the various processes in the system and are the basic units for constructing the graph model. The system defines rich attributes for each node, including the name of the process, the process identifier (PID), the user to which it belongs, the running status, the start time, etc. These attributes help to comprehensively understand the basic information and running status of each process. For example, the PID can uniquely determine the identity of the process, the user to which it belongs can reveal the privilege level and running environment of the process, and the running status can reflect whether the process is active, dormant or terminated, etc. These information are crucial for analyzing the behavior patterns and potential anomalies of the process.

[0087] For the communication relationships between processes, the system creates edges connecting the corresponding process nodes based on the communication link information recorded in the communication dataset. The system defines edge attributes in detail for each edge. The communication type can be shared memory, message queue, pipe communication, socket communication, etc. There are significant differences in security characteristics among different communication types. For example, shared memory communication may have the risk of memory tampering, while socket communication requires attention to the legality of network data packets. The communication direction can be unidirectional or bidirectional, which reflects the data flow path and is of great significance for identifying the active and passive parties in the communication. The data volume size can reflect the scale and frequency of communication. For example, a large number of frequent small data packet transmissions or occasional ultra-large data packet transmissions may imply potential abnormal communication behaviors. Based on these edge attributes, the system accurately constructs the topological structure of inter-process communication and generates an initial directed graph model. In the graph model, the direction of the arrow clearly indicates the initiator and receiver of the communication, thus vividly presenting the communication relationships and data flow directions among the internal processes of the system, providing an intuitive and comprehensive visualization basis for subsequent situation awareness analysis, enabling the system to grasp the cooperation mode and potential communication anomaly points among processes as a whole.

[0088] S22: Process the initial directed graph model, traverse the process dependency relationships, calculate the in-degree and out-degree of nodes, and generate a dependency relationship graph.

[0089] Specifically, the system can adopt the depth-first search algorithm. Starting from each node in the initial directed graph model, the system deeply explores the dependency relationships between processes along the communication links. This traversal method helps to comprehensively understand the indirect calls and data flow paths between processes, rather than just the direct communication relationships. The system maintains the access status of each node during the traversal process. The visited nodes are marked to avoid repeated traversal, thereby improving the traversal efficiency. At the same time, the system uses a stack structure to manage the node access order during the traversal process to ensure the depth and accuracy of the traversal. In addition, the system can also adopt the breadth-first search algorithm to supplement the traversal of the initial directed graph model. The breadth-first search advances layer by layer centered on the nodes, which helps to discover the parallel communication paths and many-to-many communication relationships between processes. By combining these two algorithms, the system ensures a comprehensive exploration of the process dependency relationships.

[0090] During the traversal process, the system records in detail the in-degree and out-degree of each node. The in-degree represents the number of edges pointing to the node, reflecting the degree of dependence of other processes on this process; the out-degree represents the number of edges pointing out from the node, reflecting the degree of dependence of this process on other processes. Using this in-degree and out-degree information, the system can quantitatively analyze the strength of the dependence relationship between processes. For example, a process with a high in-degree may be a service process frequently called by multiple other processes, while a process with a high out-degree may be a client process that needs to interact frequently with other processes to complete its functions. During this process, the system also conducts a hierarchical analysis of the dependence relationship, identifies the hierarchical structure and call links between processes, classifies the dependence relationship into direct dependence and indirect dependence, and demonstrates the complex dependence relationship between processes by constructing a dependence hierarchy tree. At the same time, the system can adopt an association rule mining algorithm to discover potential dependence relationships between processes. These relationships may not be obvious in the initial directed graph model, but by analyzing the communication patterns and behavioral characteristics between processes, the system can mine these hidden dependence relationships and incorporate them into the dependence relationship graph. In this way, the system generates a detailed dependence relationship graph, which not only shows the communication paths between processes, but also reflects the dependence strength and hierarchical relationship between processes, providing an important reference basis for subsequent dynamic weight adjustment.

[0091] S23: Process the dependence relationship graph through dynamic weight update technology, adjust the edge weights according to the communication frequency and data volume, and generate a directed graph model.

[0092] Specifically, the system monitors the dynamic changes in the communication between processes in real time. Whenever the communication frequency or data volume changes, the system will dynamically adjust the weight of the edge according to the preset weight update rules. For example, if the communication frequency between two processes increases significantly over a period of time, the system will correspondingly increase the weight of this edge to reflect their closer association and more important communication relationship; conversely, if the communication frequency decreases, the system will decrease the weight of the edge. At the same time, the system will also consider the impact of the data volume on the weight. Communication links with a larger data volume usually receive a higher weight because they may carry more important business data or more frequent interaction information.

[0093] In this process, the system adopts a dynamic weight update algorithm. According to the changing trends of communication frequency and data volume, it dynamically adjusts the step size and frequency of weight update to ensure that the weights can timely reflect the changes in communication behavior, while avoiding excessive weight fluctuations that may cause model instability. In addition, the system also introduces a time decay factor, which weakens the influence of communication behavior in the past period on the current weights, so that the weights can better reflect the latest state of communication relationships. In this way, the system can dynamically reflect the real-time changes in inter-process communication, making the directed graph model more accurately depict the communication behavior and dependency relationships among processes in the system, providing a high-quality topological model for subsequent situation awareness analysis, and helping to detect potential abnormal communications and network threats in a timely manner. The system also monitors and evaluates the weight adjustment process. By analyzing the trends and amplitudes of weight changes, it identifies possible abnormal communication behaviors, such as sudden large increases or decreases in weights, which may indicate the occurrence of network attacks or other abnormal events, thus providing important early warning information for network security situation awareness.

[0094] In one embodiment, as Figure 2 shown, step S3 of a network security situation awareness method for multi-source data fusion provided by the present invention specifically includes the following steps:

[0095] S31: Process the directed graph model through the sliding time window technique, and statistically calculate the mean value of communication frequency and the variance of data volume at preset time intervals to generate a time series feature sequence.

[0096] Specifically, the system sets the size of the sliding time window, which is determined based on the dynamics of the network environment and the requirements for real-time monitoring, ensuring that it can capture both short-term fluctuations in communication patterns and reflect long-term trends. Within each time window, the system deeply analyzes each edge in the directed graph model, accurately calculates the mean value of communication frequency, which reflects the activity level of communication within a specific time interval. At the same time, the system conducts a detailed variance analysis of the data volume distribution, quantifying the stability of data transmission by calculating the variance of the data volume. Links with a large variance in data volume may imply abnormal large-scale data transmissions or frequent small-scale data interactions, which may be signs that attackers are trying to transmit malicious data through covert channels. The system integrates these statistical results into a time series feature sequence, which not only records the changing trends of communication frequency and data volume but also provides key quantitative indicators for subsequent anomaly detection steps, enabling the system to dynamically track the evolution of communication patterns and timely detect potential abnormal behaviors.

[0097] S32: Process the time series feature sequence through the DBSCAN clustering algorithm, and screen out outlier feature vectors according to the density distribution to generate an initial abnormal signal set.

[0098] Specifically, the DBSCAN algorithm, based on the principle of density-based clustering, can effectively identify dense regions and outliers in the data space. In this embodiment, the system regards each feature vector in the time-series feature sequence as a point in the data space, and these feature vectors contain key information such as the mean communication frequency, the variance of the data volume, and the directional feature. The system determines the density distribution by calculating the number of neighbors of each point, and sets a density threshold to distinguish between dense regions and sparse regions. For those feature vectors located in the sparse region, that is, outlier feature vectors, their features are significantly different from most normal communication patterns and may represent potential abnormal communication behaviors. The system filters out these outlier feature vectors to form an initial abnormal signal set, providing key objects of concern for the subsequent abnormal signal discrimination step. This process is like precisely locating abnormal signals that are incompatible with the normal pattern in complex and ever-changing communication data, helping the system quickly focus on potential security threats.

[0099] S33: Process the initial abnormal signal set through threshold filtering technology, calculate the abnormal score threshold, and remove the signals in the initial abnormal signal set that are lower than the abnormal score threshold to generate a first abnormal signal set.

[0100] Specifically, the system comprehensively evaluates each signal in the initial abnormal signal set according to a preset abnormal score threshold calculation formula. This formula comprehensively considers the three key factors of the mean communication frequency, the variance of the data volume, and the directional feature, and balances their relative importance in abnormal evaluation through weight coefficients α, β, and γ. Specifically, the calculation formula for the abnormal score threshold is:

[0101]

[0102] where, P score is the abnormal score threshold, α, β, γ are weight coefficients, and α + β + γ = 1, F is the mean communication frequency of the initial abnormal signal set, μ [[ID=!5]] F and σ F are respectively the mean and standard deviation of the historical normal communication frequencies, D is the data volume variance, μ D and σ D are respectively the mean and standard deviation of the historical normal data volume variances, Dir is the directional feature, μ Dir and σ Dir are respectively the mean and standard deviation of the historical normal directional features, used to evaluate the abnormal degree of communication directionality. The system calculates the abnormal score of each abnormal signal according to this formula, removes the signals with scores lower than the abnormal score threshold, thereby retaining the signals most likely to represent real abnormalities, and generating a first abnormal signal set. This process effectively reduces false alarms, improves the accuracy and reliability of abnormal detection, and provides high-quality abnormal signal data for subsequent in-depth analysis and threat identification.

[0103] The network security situation awareness method based on multi-source data fusion provided by the above embodiments can effectively solve the problems of lack of temporal correlation and high false alarm rate in traditional network security detection methods when facing dynamic covert channels through temporal feature extraction and multi-dimensional anomaly scoring mechanism; dynamically statistics the communication links in the directed graph model based on the sliding time window technology, continuously captures the time series change rules of the mean of communication frequency, the variance of data volume and the directional characteristics, breaking through the limitation of the static threshold detection's lag in responding to the sudden and periodic characteristics of attack behaviors; conducts density analysis on the high-dimensional temporal features through the DBSCAN clustering algorithm, accurately identifies the outlier feature vectors deviating from the normal communication density, and constructs an anomaly scoring threshold model by combining the mean and standard deviation of the historical normal data distribution, thereby significantly improving the detection sensitivity of weak anomaly signals; in particular, the anomaly scoring threshold fuses the multi-dimensional deviation degrees of communication frequency, data volume distribution and directional characteristics, and dynamically adjusts the contribution weights of different features through the weighting coefficient, which can not only avoid the defect that single feature detection is vulnerable to business fluctuations, but also solve the problem of insufficient adaptability of traditional fixed weight models to different attack scenarios. Compared with the prior art, through the temporal feature dynamic modeling and multi-dimensional anomaly scoring cooperation mechanism, this method can effectively distinguish normal business fluctuations from potential covert channel behaviors without presetting an attack feature library, significantly reducing the risk of false alarms and missed detections caused by environmental noise or outdated rule libraries, and providing an interpretable and adaptive technical path for the detection of advanced threats evolving dynamically in complex network environments.

[0104] In one of the embodiments, as Figure 3 shown, step S4 of a network security situation awareness method based on multi-source data fusion provided by the present invention specifically includes the following steps:

[0105] S41: Process the normal communication mode data set through adversarial sample enhancement technology to generate a training sample set containing adversarial noise, and train a support vector machine classifier through a transfer learning algorithm to generate a robust classifier model.

[0106] Specifically, the adversarial sample enhancement technique enhances the model's generalization ability by adding carefully designed adversarial noise to the original data. In this embodiment, the system analyzes the normal communication mode dataset and extracts its key features, such as communication frequency distribution, data volume size, directional features, etc. Then, the system uses a Generative Adversarial Network (GAN) or other adversarial sample generation algorithms to generate training samples containing adversarial noise. These adversarial noise samples can simulate potential attack behaviors, making the training dataset more diverse and challenging. The generated training sample set contains both the original normal communication data and the data with added adversarial noise, thus comprehensively covering normal communication patterns and possible abnormal variants.

[0107] The system uses a transfer learning algorithm to train a Support Vector Machine (SVM) classifier. Transfer learning can effectively utilize existing knowledge and feature representations by fine-tuning on a pre-trained model, accelerating the training process and improving the model's performance. The system uses the dataset enhanced with adversarial samples to train the SVM classifier, enabling it to learn a robust feature representation of the normal communication mode, thereby generating a classifier model with strong robustness. This robust classifier model can not only accurately classify in normal communication modes but also effectively identify abnormal communication modes containing adversarial noise, improving the system's detection ability in the face of complex attacks.

[0108] S42: Process the first abnormal signal set through context-aware classification technology, combine the robust classifier model and the graph neural network to analyze the inter-process topological dependencies, filter out false alarm signals matching the normal mode, and generate an intermediate abnormal signal set.

[0109] Specifically, the context-aware classification technology takes into account the context information of communication behaviors, including the topological dependencies between processes, the time-series characteristics of communication, etc. In this embodiment, the system combines a robustness classifier model and a Graph Neural Network (GNN) to deeply analyze the signals in the first abnormal signal set. The robustness classifier model makes a preliminary evaluation of each abnormal signal to determine whether it has potential abnormal characteristics, and the graph neural network analyzes the topological dependencies between processes, capturing the communication patterns and interaction relationships between processes through the graph structure. The graph neural network can learn the embedding representations of process nodes and communication edges, which contain the structural information and context features between processes. The system fuses the output of the classifier model and the analysis results of the graph neural network to more accurately identify the false alarm signals that match the normal mode and filter them out. After this processing, the system generates an intermediate abnormal signal set, which removes most of the false alarm signals and retains the signals that are more likely to be real anomalies. This classification technology that combines context information improves the accuracy and reliability of anomaly detection, providing a cleaner data basis for further in-depth analysis.

[0110] S43: Process the intermediate abnormal signal set through spatio-temporal graph convolution technology, reconstruct the spectral edge weights based on the time-series characteristics of the communication link, and generate a second abnormal signal set.

[0111] Specifically, the system uses spatio-temporal graph convolution technology to capture the dynamic changes of the communication link in different time windows, thereby more accurately reconstructing the spectral edge weights. This method takes into account the continuity and change trend of the communication link in the time dimension, enabling the generated spectral edge weights to more accurately reflect the current state of the communication link and potential abnormal behaviors. Preferably, the second abnormal signal set is generated through the following steps:

[0112] S431: Process the intermediate abnormal signal set through the node weight decay algorithm to reduce the spectral influence of inactive nodes and generate an updated weight spectrum.

[0113] Specifically, the node weight decay algorithm dynamically adjusts the weight according to the activity of the node. The activity can be comprehensively evaluated by indicators such as the communication frequency and data transmission volume of the node. Nodes with high communication frequencies and large data transmission volumes are usually considered more active. The decay formula of the node weight decay algorithm can be expressed as:

[0114] W new =W old *λ activity

[0115] where W new is the updated weight, W old is the original weight, λactivity is the decay factor of the activity index of nodes, with a value between 0 and 1. The system applies a weight decay algorithm to gradually reduce the weights of these inactive nodes, weakening their influence in the graph. This process not only helps to highlight the communication behaviors of active nodes but also reduces the interference of inactive nodes on anomaly detection. In this way, the system generates an updated weight graph, providing a more accurate topological basis for subsequent anomaly edge attribute correlation analysis, making anomaly detection more focused on the currently active communication links and improving the detection efficiency and accuracy.

[0116] S432: Process the updated weight graph, fuse historical attack chain patterns to identify anomaly edge attribute correlations, highlight the visual markers of high-frequency anomaly links, and generate a strengthened marker graph.

[0117] Specifically, historical attack chain patterns are typical attack paths and behavior patterns summarized from past network security incidents. These patterns reflect the possible steps and link characteristics that attackers may take. The system matches and conducts correlation analysis on these historical attack chain patterns with the updated weight graph. By analyzing the attributes of edges in the current graph, such as communication frequency, data volume, directionality, etc., and comparing them with historical attack chain patterns, anomaly edge attribute correlations with similar characteristics are identified. For those edges that highly match the historical attack chain patterns, the system considers the possibility of anomalies to be relatively high and thus strengthens the marking, especially highlighting high-frequency anomaly links in the interface visualization. These high-frequency anomaly links may be the propagation paths of potential attacks. Through strengthened marking, the system can help analysts more intuitively discover and focus on these key links, thereby quickly locating potential threats in complex communication networks. The strengthened marker graph not only retains the topological structure of the original graph but also enhances the expressiveness of anomaly information through visualization means, providing strong support for subsequent threat analysis and response.

[0118] S433: Process the strengthened marker graph through a spatio-temporal probability graph model, model the time dependence and spatial propagation probability of communication links, and generate a second set of anomaly signals.

[0119] Specifically, the spatio-temporal probability graph model is a probability model that combines the temporal and spatial dimensions and is used to analyze the dynamic behavior of communication links and potential propagation patterns. For each edge in the enhanced labeled graph spectrum, the system analyzes its communication pattern in the time series and establishes a time-dependence model. This includes characteristics such as the frequency, duration, and periodicity of communication occurrences to capture the behavioral patterns of communication links changing over time. At the same time, the system considers the spatial distribution of the links, that is, the geographical locations and network topological positions between different nodes, calculates the spatial propagation probability, and evaluates the possibility of abnormal communication spreading in space. By combining the probability models of the temporal and spatial dimensions, the system can more comprehensively understand the abnormal characteristics of communication links and identify those links that exhibit abnormalities both temporally and spatially. Finally, based on the analysis results of the spatio-temporal probability graph model, the system generates a second set of abnormal signals. This signal set not only contains the identifiers of the abnormal links but also provides detailed information about their temporal and spatial abnormal characteristics, providing more in-depth and accurate abnormal signals for subsequent covert channel detection and threat alerts, and helping to timely detect and respond to potential network security threats.

[0120] A network security situation awareness method based on multi-source data fusion provided by the above embodiment significantly improves the robustness, accuracy, and dynamic adaptability of covert channel detection in complex network environments through the collaborative mechanism of adversarial sample enhancement, context-aware classification, and spatio-temporal graph convolution technology, effectively solving the false alarm and missed alarm problems caused by insufficient attack samples, lack of context correlation, and static model rigidity in traditional methods. Compared with the prior art, the present invention realizes the full-process optimization from data enhancement, context correlation analysis to temporal-spatial modeling through the collaboration of multiple technologies, and can accurately identify highly camouflaged and continuously evolving covert channels without a prior attack feature library, providing reliable technical support for the active defense against advanced persistent threats.

[0121] In one of the embodiments, step S5 of a network security situation awareness method based on multi-source data fusion provided by the present invention specifically includes the following steps:

[0122] S51: Process the second set of abnormal signals through feature normalization technology to eliminate the dimensional difference and generate a standardized feature vector set.

[0123] Specifically, feature normalization can ensure that each feature is compared and analyzed on the same scale. The system first analyzes each feature vector in the second set of abnormal signals to identify different feature dimensions, such as communication frequency, data volume, directional features, etc. In this embodiment, the system applies a normalization algorithm, such as min-max normalization or Z-score normalization, to transform each feature value into a unified numerical range, usually [0,1] or [-1,1]. Min-max normalization scales the feature value to the specified range through linear transformation, while Z-score normalization makes the feature value have zero mean and unit variance by subtracting the mean and dividing by the standard deviation. Through this normalization process, the system can eliminate the dimension difference and ensure that each feature has the same importance in subsequent similarity calculations. Finally, the system generates a set of standardized feature vectors, providing a unified data basis for subsequent covert channel pattern matching.

[0124] S52: Process the set of standardized feature vectors through the cosine similarity algorithm, match the preset covert channel pattern, and generate a set of similarity scores.

[0125] Specifically, cosine similarity is applicable to high-dimensional data and can effectively measure the similarity degree of two vectors in terms of direction. In this embodiment, the system represents the preset covert channel patterns as feature vectors, and these pattern feature vectors contain typical features of known covert channels, such as specific communication frequency patterns, data volume distributions, directional features, etc. Then, the system calculates the cosine similarity between each vector in the set of standardized feature vectors and the preset pattern feature vectors. The calculation formula of cosine similarity is:

[0126]

[0127] where similarity is the cosine similarity, A and B are two feature vectors respectively, and θ is the angle between them. In this way, the system can quantify the similarity degree between each abnormal signal and the covert channel pattern and generate a set of similarity scores. Each score value in the set of similarity scores reflects the matching degree of the corresponding communication link with the covert channel pattern, providing data support for subsequent threshold determination.

[0128] S53: Process the set of similarity scores through dynamic threshold determination technology, calculate the dynamic similarity threshold and screen the communication links in the set of similarity scores that exceed the dynamic similarity threshold, and extract the process identifier, communication type, and timestamp from the communication dataset based on the unique identifier of the screened communication links to generate a covert channel set.

[0129] Specifically, the core of the dynamic threshold determination technology lies in dynamically adjusting the similarity threshold according to the historical data of the system and the current security situation, so as to adapt to the changing network environment and attack patterns. The calculation formula for the dynamic similarity threshold of the system is:

[0130]

[0131] Where, T threshold (t) is the dynamic similarity threshold, T base is the initial similarity threshold obtained by statistical analysis of historical attack data, λ is the threat intelligence gain coefficient, k is the time decay factor, t is the current time, t0 is the initial attack detection time, and e is the natural constant. Through this formula, the system can dynamically adjust the similarity threshold according to the difference between the current time and the initial attack detection time. When the similarity score exceeds the dynamic similarity threshold, the system determines that there may be a covert channel in the corresponding communication link and extracts the unique identifier of the link from the communication dataset. Based on these unique identifiers, the system further extracts relevant process identifiers, communication types, and timestamp information to generate a covert channel set. This set not only contains detailed information about potential covert channels but also ensures the accuracy and adaptability of the determination results through the dynamic threshold determination technology, providing strong support for network security situation awareness.

[0132] Preferably, as Figure 4 shown, the present invention provides a network security situation awareness device 600 for multi-source data fusion, which is configured with the following modules:

[0133] A data acquisition and processing module 610, which is used to perform multi-source data acquisition and standardization processing on the kernel logs and network traffic of the system to be detected, extract function call sequences, pipe communication metadata, and network socket connection data, and generate a communication dataset;

[0134] A dynamic graph construction module 620, which is used to construct a dynamic process link graph for the communication dataset, define edge attributes with processes as nodes and communication links as edges, and generate a directed graph model. The directed graph model is used to represent the topological relationship of the communication type, frequency, and data volume between processes;

[0135] An abnormal link preliminary screening module 630, which is used to perform time-series feature extraction and abnormal preliminary screening on the directed graph model based on the sliding time window statistics and time-series analysis technology, calculate the average communication frequency, data volume distribution variance, and directional characteristics of each edge, and generate a first abnormal signal set. The first abnormal signal set is used to identify potential threat links that deviate from the normal communication mode;

[0136] The abnormal signal enhancement module 640 is used to perform multi-model fusion and denoising filtering on the first abnormal signal set, identify false alarm signals through a support vector machine classifier, and dynamically adjust weights using an incremental graph update algorithm to generate a second abnormal signal set;

[0137] The covert channel screening module 650 is used to perform covert channel pattern matching on the second abnormal signal set, calculate the similarity between the feature vectors and the preset covert channel patterns, generate a covert channel set, and the covert channel set is used to output threat alarm information including process identifiers, communication types, and timestamps.

[0138] In summary, the network security situation awareness device based on multi-source data fusion provided by the present invention breaks through the limitations of traditional single data source detection by systematically integrating multi-source heterogeneous data such as kernel logs and network traffic, and can effectively solve technical bottlenecks such as difficult identification of weak signals in covert channels, insufficient modeling of dynamic attack behaviors, and high false alarm rates. Compared with the prior art, the present invention can achieve full-process dynamicization and intelligence from data collection, feature analysis to threat determination, thereby improving the perception accuracy and response timeliness of covert threats in complex network environments, and providing reliable technical support for the active defense against advanced persistent threats.

[0139] Preferably, the data acquisition and processing module 610 provided in this embodiment is configured with the following units:

[0140] The process data generation unit is used to process the kernel logs of the system to be detected based on eBPF tools, collect function call sequences, pipe communication metadata, and local socket connection data in real time, and generate inter-process communication data;

[0141] The communication data generation unit is used to process the network traffic of the system to be detected through TCPDump network traffic parsing technology, capture network socket communication data, and parse protocol headers and payload lengths to generate network communication data;

[0142] The data standard processing unit is used to process the inter-process communication data and network communication data based on data format standardization technology, unify timestamps and data volume units, and generate a communication data set.

[0143] Preferably, the dynamic graph construction module 620 provided in this embodiment is configured with the following units:

[0144] The initial model construction unit is used to process the first communication data set through graph structure modeling technology, define process node attributes and communication link edge attributes, and generate an initial directed graph model;

[0145] The dependency graph generation unit is used to process the initial directed graph model, traverse the process dependencies, and calculate the in-degree and out-degree of nodes to generate a dependency graph;

[0146] The model update adjustment unit is used to process the dependency graph through dynamic weight update technology, adjust the edge weight according to the communication frequency and data volume, and generate a directed graph model.

[0147] Preferably, the abnormal link initial screening module 630 provided in this embodiment is configured with the following units:

[0148] A time series generation unit is used to process the directed graph model using a sliding time window technique, calculate the mean value of the communication frequency and the variance of the data volume at preset time intervals, and generate a time series feature sequence;

[0149] The initial signal generation unit is used to process the time series feature sequence through the DBSCAN clustering algorithm, filter outlier feature vectors according to density distribution, and generate an initial abnormal signal set;

[0150] The abnormal signal set generating unit is used to process the initial abnormal signal set through the threshold filtering technology, calculate the abnormal score threshold and eliminate the signals below the abnormal score threshold in the initial abnormal signal set to generate the first abnormal signal set.

[0151] Preferably, the abnormal signal enhancement module 640 provided in this embodiment is configured with the following units:

[0152] A robust classifier model building unit is used to process a normal communication mode dataset using adversarial sample enhancement technology to generate a training sample set containing adversarial noise, and to train a support vector machine classifier using a transfer learning algorithm to generate a robust classifier model;

[0153] An intermediate abnormal signal set generation unit is used to process the first abnormal signal set through context-aware classification technology, combine the robust classifier model and graph neural network to analyze the topological dependencies between processes, filter out false positive signals that match normal patterns, and generate an intermediate abnormal signal set;

[0154] The second abnormal signal set generating unit is used to process the intermediate abnormal signal set by using the spatiotemporal graph convolution technology, reconstruct the graph edge weights based on the time series characteristics of the communication link, and generate the second abnormal signal set.

[0155] Preferably, the second abnormal signal set generation unit includes a graph weight update subunit, a graph marker enhancement subunit, and a graph time-space processing subunit. Among them, the graph weight update subunit is used to process the intermediate abnormal signal set through a node weight decay algorithm, reduce the graph influence of inactive nodes, and generate an updated weight graph; the graph marker enhancement subunit is used to process the updated weight graph, fuse the historical attack chain pattern recognition of abnormal edge attribute associations, highlight the visual markers of high-frequency abnormal links, and generate an enhanced marker graph; the graph time-space processing subunit is used to process the enhanced marker graph through a spatio-temporal probability graph model, model the time dependence and spatial propagation probability of communication links, and generate a second abnormal signal set.

[0156] Preferably, the covert channel screening module 650 provided in this embodiment is configured with the following units:

[0157] A standard feature generation unit, which is used to process the second abnormal signal set through feature normalization technology, eliminate the dimension difference, and generate a standardized feature vector set;

[0158] A similarity scoring unit, which is used to process the standardized feature vector set through a cosine similarity algorithm, match a preset covert channel pattern, and generate a similarity scoring set;

[0159] A covert channel generation unit, which is used to process the similarity scoring set through a dynamic threshold determination technology, calculate a dynamic similarity threshold and screen the communication links in the similarity scoring set that exceed the dynamic similarity threshold, and extract the process identifier, communication type, and timestamp from the communication dataset based on the unique identifier of the screened communication links, and generate a covert channel set.

[0160] In one embodiment, the present application also provides a computer device, including a memory and a processor, where the memory stores a computer program, and when the processor executes the computer program, it implements the above-mentioned multi-source data fusion network security situation awareness method.

[0161] In one embodiment, the present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the above-mentioned multi-source data fusion network security situation awareness method.

[0162] In the description of this specification, the descriptions referring to terms such as "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" mean that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. Moreover, the specific features, structures, materials, or characteristics described can be combined in a suitable manner in any one or more embodiments or examples. In addition, without contradiction, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0163] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to the partial descriptions of the method embodiments. The device embodiments described above are only illustrative. The components described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the present disclosure solution. Those of ordinary skill in the art can understand and implement it without creative efforts.

[0164] As mentioned above, the above are only the specific implementation manners of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present application can easily think of various changes or substitutions, and these should all be covered by the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A network security situation awareness method based on multi-source data fusion, characterized in that The following steps are involved: S1: Collect and standardize multi-source data of kernel logs and network traffic of the system to be tested, extract function call sequences, pipeline communication metadata, and network socket connection data, and generate a communication dataset; S2: constructing a dynamic process link graph for the communication data set, defining edge attributes with processes as nodes and communication links as edges, and generating a directed graph model. The directed graph model is used to represent the topological relationship between inter-process communication types, frequencies, and data volumes; S3: Extracting time series features and performing initial anomaly screening on the directed graph model based on sliding time window statistics and time series analysis techniques, calculating the communication frequency mean, data volume distribution variance, and directional characteristics of each edge, and generating a first anomaly signal set. The first anomaly signal set is used to identify potential threat links that deviate from normal communication patterns. S4: performing multi-model fusion and denoising filtering on the first abnormal signal set, identifying false alarm signals through a support vector machine classifier and dynamically adjusting weights using an incremental graph update algorithm to generate a second abnormal signal set; S5: Perform covert channel pattern matching on the second abnormal signal set, calculate the similarity between the feature vector and the preset covert channel pattern, and generate a covert channel set. The covert channel set is used to output threat alarm information including process identifier, communication type and timestamp.

2. The method according to claim 1, characterized in that, Said S1 comprises: S11: Process the kernel logs of the system to be tested using the eBPF tool, collect function call sequences, pipeline communication metadata, and local socket connection data in real time, and generate inter-process communication data; S12: Process the network traffic of the system to be detected by using TCPDump network traffic analysis technology, capture network socket communication data and analyze the protocol header and payload length to generate network communication data; S13: Processing the inter-process communication data and the network communication data based on data format standardization technology, unifying timestamps and data volume units, and generating a communication data set.

3. The method according to claim 1, characterized in that The S2 includes: S21: Processing the communication data set using graph structure modeling technology, defining process node attributes and communication link edge attributes, and generating an initial directed graph model; S22: Processing the initial directed graph model, traversing process dependencies and calculating node in-degree and out-degree to generate a dependency graph; S23: Processing the dependency graph through dynamic weight updating technology, adjusting edge weights according to communication frequency and data volume, and generating a directed graph model.

4. The method according to claim 1, wherein The S3 includes: S31: Processing the directed graph model using a sliding time window technology, calculating the communication frequency mean and data volume variance at preset time intervals, and generating a time series feature sequence; S32: Processing the time series feature sequence by using the DBSCAN clustering algorithm, screening outlier feature vectors according to density distribution, and generating an initial abnormal signal set; S33: Process the initial abnormal signal set using a threshold filtering technique, calculate an abnormality score threshold, and remove signals in the initial abnormal signal set that are below the abnormality score threshold to generate a first abnormal signal set. The calculation formula for the abnormality score threshold is: Among them, P score is the abnormal score threshold, α, β, and γ are weight coefficients, and α + β + γ = 1, F is the mean communication frequency of the initial abnormal signal set, μ F and σ F are the mean and standard deviation of the historical normal communication frequency respectively, D is the data volume variance, μ D and σ D are the mean and standard deviation of the historical normal data volume variance respectively, Dir is the directional feature, μ Dir and σ Dir are the mean and standard deviation of the historical normal directional feature respectively.

5. The method according to claim 1, characterized in that, The S4 includes: S41: Process the normal communication mode dataset through adversarial sample enhancement technology to generate a training sample set containing adversarial noise, and train a support vector machine classifier through a transfer learning algorithm to generate a robust classifier model; S42: Process the first abnormal signal set through context-aware classification technology, combine the robust classifier model and the graph neural network to analyze the topological dependencies between processes, filter out false alarm signals matching the normal mode, and generate an intermediate abnormal signal set; S43: Process the intermediate abnormal signal set through spatio-temporal graph convolution technology, reconstruct the spectral edge weights based on the time series characteristics of the communication link, and generate a second abnormal signal set.

6. The method according to claim 5, wherein The S43 includes: S431: Process the intermediate abnormal signal set through a node weight decay algorithm to reduce the spectral influence of inactive nodes and generate an updated weight spectrum; S432: Process the updated weight spectrum, fuse the historical attack chain pattern recognition of abnormal edge attribute associations, highlight the visual markers of high-frequency abnormal links, and generate a strengthened marker spectrum; S433: Process the strengthened marker spectrum through a spatio-temporal probability graph model, model the time dependence and spatial propagation probability of the communication link, and generate a second abnormal signal set.

7. The method according to any one of claims 1-6, characterized in that, The S5 includes: S51: Process the second abnormal signal set through feature normalization technology to eliminate the dimension difference and generate a standardized feature vector set; S52: Process the standardized feature vector set through a cosine similarity algorithm to match the preset covert channel pattern and generate a similarity score set; S53: Process the similarity score set through a dynamic threshold determination technology, calculate the dynamic similarity threshold and filter out the communication links in the similarity score set that exceed the dynamic similarity threshold, and extract the process identifier, communication type, and timestamp from the communication dataset based on the unique identifiers of the filtered communication links to generate a covert channel set. The calculation formula of the dynamic similarity threshold is: Among them, Tt hreshold (t) is the dynamic similarity threshold, T base is the initial similarity threshold obtained from the historical attack data statistics, λ is the threat intelligence gain coefficient, k is the time decay factor, t is the current time, t0 is the initial attack detection time, and e is the natural constant.

8. A network security situation awareness device for multi-source data fusion, characterized in that The device includes: A data acquisition and processing module, which is used to perform multi-source data acquisition and standardization processing on the kernel logs and network traffic of the system to be detected, extract function call sequences, pipe communication metadata, and network socket connection data, and generate a communication dataset; A dynamic graph construction module, which is used to construct a dynamic process link graph for the communication dataset, define edge attributes with processes as nodes and communication links as edges, and generate a directed graph model, which is used to represent the topological relationship of the communication type, frequency, and data volume between processes; An abnormal link preliminary screening module, which is used to extract the time series characteristics and perform preliminary abnormal screening on the directed graph model based on the sliding time window statistics and time series analysis technology, calculate the average communication frequency, data volume distribution variance, and directional characteristics of each edge, and generate a first abnormal signal set, which is used to identify potential threat links deviating from the normal communication mode; An abnormal signal enhancement module, which is used to perform multi-model fusion and denoising filtering on the first abnormal signal set, identify false alarm signals through a support vector machine classifier, and dynamically adjust weights by using an incremental graph update algorithm to generate a second abnormal signal set; A covert channel screening module, which is used to perform covert channel pattern matching on the second abnormal signal set, calculate the similarity between the feature vector and the preset covert channel pattern, generate a covert channel set, and the covert channel set is used to output threat warning information including process identification, communication type and time stamp.

9. A computer device, comprising a memory and a processor, the memory storing a computer program, characterized in that, When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, the method according to any one of claims 1 to 7 is implemented.

Images