Visual early warning method and system for network security event

Abstract

The invention provides a visual early warning method and system for a network security event in the cross technical field of network security and machine learning, and the method comprises the steps: S1, creating a security event recognition model, and setting a loss function of the security event recognition model; s2, acquiring historical monitoring data to construct a data set; s3, the data set is divided into a training set, a verification set and a test set, and the training set, the verification set and the test set are respectively utilized to train, verify and test the security event identification model; s4, performing knowledge distillation and deployment on the security event recognition model passing the test; s5, collecting real-time monitoring data, and inputting the data into the security event recognition model to obtain a security event recognition report; and S6, displaying the security event identification report and statistical data of the security event identification report and the real-time monitoring data in real time through a visual interface. The method has the advantage that the accuracy and the timeliness of early warning of the network security event are greatly improved.

Description

Technical Field

[0001] The present invention relates to the interdisciplinary field of network security and machine learning, and in particular to a method and system for visualizing and warning network security events. Background Art

[0002] In the context of the digital economy, the scale of global Internet users has exceeded 5 billion, and the process of digital transformation of enterprises is accelerating. This technological innovation has not only reconstructed the business operation model, but also spawned a new business architecture system based on cloud platforms, covering key areas such as e-government, financial transactions, and intelligent manufacturing.

[0003] Because cloud platforms built by enterprises involve large amounts of valuable business data and user privacy data, they are frequently attacked, and cyberspace attack and defense confrontations exhibit significant asymmetry. According to Check Point's 2023 Cybersecurity Report, global enterprises suffer an average of 1,128 cyber attacks per week, a 50% surge from 2020. Of particular concern are APT attacks (advanced persistent threats) targeting cloud platforms, whose attack complexity is growing exponentially. In terms of security protection practices, the traditional model of manually monitoring security incidents and issuing early warnings is facing multiple technical bottlenecks: 1. Physiological limitations of human cognition: According to research by the CERT Center at Carnegie Mellon University, security analysts' threat identification accuracy drops by 40%-60% after four hours of continuous work. This phenomenon is particularly prominent when dealing with new attack methods, such as advanced attack techniques like zero-day exploits and living-off-the-land attacks. The average misjudgment rate of manual analysis is as high as 32%.

[0004] 2. The gap in traffic processing capabilities is widening: According to Cisco's annual Internet report, global IP traffic will exceed 4.8ZB / year by 2025, of which enterprise cloud platform traffic will account for more than 70%. Faced with this data torrent, traditional manual sampling models have serious technical adaptability issues, resulting in a large number of covert attacks escaping detection.

[0005] 3. Timeliness has become the Achilles' heel of security defenses: Traditional manual analysis of a single security incident takes an average of 17 minutes, while modern ransomware attacks move laterally at an increasingly faster speed, resulting in a substantial loss of defense windows.

[0006] 4. Visual presentation defects: After manually monitoring a security incident, relevant warning information needs to be manually entered, and real-time statistics and display cannot be performed, which affects the timeliness of the warning.

[0007] Therefore, how to provide a network security incident visual warning method and system to improve the accuracy and timeliness of network security incident warning has become a technical problem that needs to be solved urgently. Summary of the Invention

[0008] The technical problem to be solved by the present invention is to provide a method and system for visualizing early warning of network security events, so as to improve the accuracy and timeliness of early warning of network security events.

[0009] In a first aspect, the present invention provides a method for visually warning network security events, comprising the following steps: Step S1: creating a security event recognition model based on the multimodal feature extraction layer, the cross-modal association layer, the real-time decision layer, and the dynamic feedback layer, and setting a loss function of the security event recognition model; The multimodal feature extraction layer is used to extract traffic time series features, log event features, intelligence graph features, network topology features, user behavior features and deep semantic features from the input monitoring data; The cross-modal association layer is used to fuse traffic time series features, log event features, intelligence graph features, network topology features, user behavior features, and deep semantic features to obtain global threat features; The real-time decision-making layer is used to output a security event identification report based on global threat characteristics; The dynamic feedback layer is used to construct adversarial samples based on the input monitoring data, and continuously optimize the model parameters of the multimodal feature extraction layer, the cross-modal association layer, and the real-time decision layer based on the adversarial samples; The formula of the loss function is: ; in, Represents the loss value of the loss function; Represents the feature reconstruction loss sub-function, using the mean square error function; Represents the feature alignment loss sub-function, which adopts the contrast loss function; Represents the cross-modal fusion loss sub-function, using the cross entropy loss function; Represents the eigendecomposition loss subfunction, using the eigendecomposition regularized loss function; Represents the classification loss sub-function, using the cross entropy loss function; Represents the adversarial loss sub-function, using the least squares adversarial loss function; Both represent weight coefficients; as well as Both are used for optimization of multimodal feature extraction layers; as well as Both are used for optimization of cross-modal association layers; Optimization for real-time decision-making layer; Used for optimization of dynamic feedback layer; Step S2: Acquire historical monitoring data including at least network traffic data, log data, threat intelligence data, network device data, user behavior data, and social media data, and construct a data set after preprocessing and annotating each of the historical monitoring data; Step S3: Divide the data set into a training set, a validation set, and a test set, and use the training set, validation set, and test set to train, validate, and test the security event recognition model respectively; Step S4: performing knowledge distillation and deployment on the security event identification model that has passed the test; Step S5: Collect real-time monitoring data, pre-process the real-time monitoring data through the streaming computing engine, and then input it into the deployed security event identification model. The security event identification model outputs a security event identification report in the format of "event classification-confidence-associated device-handling suggestion"; Step S6: Display the security incident identification report, the statistical data of the security incident identification report and the real-time monitoring data in real time through a visual interface.

[0010] In a second aspect, the present invention provides a network security incident visual early warning system, comprising the following modules: A security event identification model creation module is used to create a security event identification model based on the multimodal feature extraction layer, the cross-modal association layer, the real-time decision layer, and the dynamic feedback layer, and set the loss function of the security event identification model; The multimodal feature extraction layer is used to extract traffic time series features, log event features, intelligence graph features, network topology features, user behavior features and deep semantic features from the input monitoring data; The cross-modal association layer is used to fuse traffic time series features, log event features, intelligence graph features, network topology features, user behavior features, and deep semantic features to obtain global threat features; The real-time decision-making layer is used to output a security event identification report based on global threat characteristics; The dynamic feedback layer is used to construct adversarial samples based on the input monitoring data, and continuously optimize the model parameters of the multimodal feature extraction layer, the cross-modal association layer, and the real-time decision layer based on the adversarial samples; The formula of the loss function is: ; in, Represents the loss value of the loss function; Represents the feature reconstruction loss sub-function, using the mean square error function; Represents the feature alignment loss sub-function, which adopts the contrast loss function; Represents the cross-modal fusion loss sub-function, using the cross entropy loss function; Represents the eigendecomposition loss subfunction, using the eigendecomposition regularized loss function; Represents the classification loss sub-function, using the cross entropy loss function; Represents the adversarial loss sub-function, using the least squares adversarial loss function; Both represent weight coefficients; as well as Both are used for optimization of multimodal feature extraction layers; as well as Both are used for optimization of cross-modal association layers; Optimization for real-time decision-making layer; Used for optimization of dynamic feedback layer; A data set construction module is used to obtain historical monitoring data including at least network traffic data, log data, threat intelligence data, network device data, user behavior data, and social media data, and to construct a data set after preprocessing and annotating each of the historical monitoring data; A security event recognition model training module is used to divide the data set into a training set, a validation set, and a test set, and respectively use the training set, validation set, and test set to train, validate, and test the security event recognition model; A security event identification model deployment module, used to perform knowledge distillation and deployment on the security event identification model that has passed the test; A security event identification module is used to collect real-time monitoring data, pre-process the real-time monitoring data through a streaming computing engine, and then input it into a deployed security event identification model. The security event identification model outputs a security event identification report in the format of "event classification-confidence-associated device-treatment recommendation"; The visual warning module is used to display the security incident identification report, the statistical data of the security incident identification report and the real-time monitoring data in real time through a visual interface.

[0011] The advantages of the present invention are: 1. Create a security event recognition model through the multimodal feature extraction layer, cross-modal association layer, real-time decision layer and dynamic feedback layer, and set the loss function of the security event recognition model; then obtain historical monitoring data including at least network traffic data, log data, threat intelligence data, network equipment data, user behavior data and social media data, pre-process and annotate each historical monitoring data to construct a data set; divide the data set into training set, validation set and test set, respectively use the training set, validation set and test set to train, verify and test the security event recognition model, and perform knowledge distillation and deployment on the security event recognition model that passes the test; then collect real-time monitoring data, pre-process the real-time monitoring data through the streaming computing engine, and input it into the deployed security event recognition model. The security event recognition model is output in the format of "event classification-confidence-associated device-handling suggestion" The security incident identification report displays the security incident identification report, security incident identification report and real-time monitoring data statistics in real time through a visual interface; that is, security incidents are identified through a pre-trained security incident identification model. The security incident identification model training process combines network traffic data, log data, threat intelligence data, network equipment data, user behavior data and social media data. Multi-dimensional data, combined with the dynamic feedback layer of the security incident identification model, is used to build adversarial samples for continuous optimization to ensure the accuracy of security incident identification; security incidents are automatically identified through the security incident identification model instead of traditional manual identification, and combined with the streaming computing engine, the efficiency of security incident identification is effectively improved; security incident identification reports and automatically counted statistics are displayed in real time through a visual interface, without the need to manually enter relevant warning information and statistics, which ultimately greatly improves the accuracy and timeliness of network security incident warnings.

[0012] 2. By building a six-modal parallel feature extraction network (multimodal feature extraction layer), TCN, Bi-LSTM-CRF, GAT, GraphSAGE, Transformer-XL, and BERT-wwm are used to differentially process heterogeneous data including network traffic data, log data, threat intelligence data, network device data, user behavior data, and social media data, thus overcoming the technical limitations of single-modal feature extraction. For example, the log event encoding module uses a Bi-LSTM-CRF network to capture causal relationships, which improves the ability to identify event correlations compared to traditional RNN models.

[0013] 3. The dynamic time warping algorithm is used to achieve spatiotemporal alignment through the cross-modal association layer, and feature fusion is achieved by combining the three-level attention mechanism (self-attention / cross-attention / gated attention). This solves the key technical problem of spatiotemporal mismatch of multi-source data. In particular, the feature weighted fusion method of the global gated attention unit effectively suppresses inter-modal noise interference.

[0014] 4. By introducing a dynamic feedback layer to construct adversarial samples for continuous optimization, and enhancing the model robustness through the least squares adversarial loss function, the security event recognition model has the ability to defend against adversarial attacks.

[0015] 5. By adopting the evidence deep learning framework for confidence assessment and quantifying uncertainty through Dirichlet distribution, the credibility of warnings is effectively improved, which is significantly higher than the traditional SoftMax output method.

[0016] 6. By building a federated learning framework for distributed training and dynamically adjusting hyperparameters through genetic algorithms, the convergence speed of the security event identification model is greatly improved and local optimal solutions are avoided. Using genetic algorithms to dynamically adjust hyperparameters such as the learning rate and batch size, combined with early stopping conditions such as the second-order derivative of the loss function approaching zero and the accuracy volatility of <0.5%, overfitting is avoided and training efficiency is improved.

[0017] 7. Through the four-dimensional output format of "event classification-confidence-associated devices-treatment recommendations", threat path tracing can be achieved through the GNNExplainer algorithm, shortening the treatment response time to minutes. Compared with the traditional method of only outputting classification results, it effectively improves operation and maintenance efficiency.

[0018] 8. By combining a streaming computing engine with multi-threading technology, it achieves real-time processing capabilities of tens of thousands of data packets per second. Through containerized deployment solutions, it supports millisecond-level model updates to meet the real-time requirements of network security scenarios. Through containerization technology, the security event identification model and its operating environment can be packaged into a portable container to ensure operational consistency in different environments.

[0019] 9. By setting the loss function to fuse six sub-loss functions and dynamically balancing the optimization objectives of each network layer through the λ coefficient, especially the introduction of the feature decomposition regularization term, the efficiency of cross-modal feature decoupling is effectively improved and the risk of overfitting is avoided.

[0020] 10. By using geographic information mapping and time alignment technology in the data preprocessing stage, the problem of unifying the spatiotemporal benchmarks of cross-regional data such as network device logs and user behavior trajectories has been solved; for example, the UTC time of the firewall log is converted to the local time zone and the time axis is calibrated with the user login behavior, effectively improving the accuracy of feature association.

[0021] 11. By proposing a joint parsing method for structured / unstructured data and extracting key fields (such as IP addresses and vulnerability numbers) through regular expressions and NLP technology, we can achieve automated processing of non-standardized log data and reduce manual labeling costs.

[0022] 12. By setting up a device association locator and using the GNNExplainer algorithm, the threat propagation path can be visualized and weak nodes can be located. For example, in APT attack detection, the lateral movement path from the border firewall to the internal host can be traced, providing a physical topology basis for security reinforcement and effectively improving the efficiency of operation and maintenance response.

[0023] 13. By integrating traffic time series, log events, intelligence graphs, network topology, user behavior and deep semantic features, it covers multi-dimensional information such as time, space, structure, behavior, and semantics for network threat detection; the TCN network processes traffic time series features to capture long-term dependencies, Bi-LSTM-CRF analyzes the causal chain of log events, the GAT network constructs a threat intelligence graph and strengthens entity relationship mining, GraphSAGE learns the dynamic connection of network topology, Transformer-XL captures the temporal dependencies of user behavior, BERT-wwm extracts the deep semantics of social media, and then through spatiotemporal alignment (dynamic time warping) and hierarchical attention mechanism (self-attention + cross-attention + gated fusion), it achieves deep fusion of heterogeneous features, effectively improving the multimodal feature fusion capability.

[0024] 14. By setting feature reconstruction loss, the integrity of feature extraction is guaranteed; by setting contrast loss, cross-modal consistency is improved; by setting adversarial loss, the model's anti-interference ability is enhanced; by setting decomposition regularization loss, overfitting is prevented; and by dynamic weight adjustment (λ1~λ6), different optimization objectives can be flexibly balanced.

[0025] 15. Generate highly realistic attack samples through the least squares adversarial loss function, effectively improving the model's detection accuracy for unknown threats (such as zero-day vulnerabilities and APT attacks).

[0026] 16. By dividing the dataset into ten data subsets and adopting a rotating partitioning strategy (selecting the validation set, test set, and training set in turn), the stability verification of the security event recognition model under different data distributions is ensured, local overfitting is avoided, and the generalization ability of the security event recognition model in unknown environments is enhanced.

[0027] 17. By adopting the generative adversarial network (GAN) to solve the class imbalance problem and combining it with the federated learning framework to protect data privacy, the generalization ability of the security event recognition model is effectively improved.

[0028] 18. The security incident recognition model is compressed through knowledge distillation, that is, through the teacher-student model architecture and multi-head attention feature mapping, the model is lightweight and the deployment resource requirements are effectively reduced.

[0029] 19. Through multimodal feature fusion (integration of traffic, logs, intelligence, topology, behavior and semantic data) and cross-modal association mechanism (spatiotemporal alignment and hierarchical attention module), combined with dynamic feedback adversarial training to optimize model robustness, and using federated learning, genetic algorithms and ten-fold cross-validation to improve training efficiency and generalization ability, and based on evidence-based deep learning and GNNExplainer to achieve high-confidence, explainable real-time decision-making, finally through lightweight deployment of knowledge distillation and multi-dimensional visualization interface, a comprehensive, adaptive and real-time network security early warning system was built, which effectively improved threat detection accuracy, response speed and system anti-attack capability. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0031] Figure 1 The present invention is a flowchart of a method for visualizing early warning of network security events.

[0032] Figure 2 It is a structural diagram of a network security incident visual early warning system of the present invention. DETAILED DESCRIPTION

[0033] The technical solution in the embodiments of the present application has the following overall idea: security incidents are identified through a pre-trained security incident identification model. During the training process of the security incident identification model, multi-dimensional data such as network traffic data, log data, threat intelligence data, network equipment data, user behavior data and social media data are combined. The dynamic feedback layer of the security incident identification model is combined to build adversarial samples for continuous optimization to ensure the accuracy of security incident identification; security incidents are automatically identified through the security incident identification model instead of traditional manual identification, and combined with the streaming computing engine, the efficiency of security incident identification is effectively improved; security incident identification reports and automatically counted statistical data are displayed in real time through a visual interface, without the need to manually enter relevant warning information and statistics, so as to improve the accuracy and timeliness of network security incident warnings.

[0034] Please refer to Figures 1 to 2 As shown, a preferred embodiment of a network security incident visual early warning method of the present invention includes the following steps: Step S1: creating a security event recognition model based on the multimodal feature extraction layer, the cross-modal association layer, the real-time decision layer, and the dynamic feedback layer, and setting a loss function of the security event recognition model; The multimodal feature extraction layer is used to extract traffic time series features, log event features, intelligence graph features, network topology features, user behavior features and deep semantic features from the input monitoring data; The cross-modal association layer is used to fuse traffic time series features, log event features, intelligence graph features, network topology features, user behavior features, and deep semantic features to obtain global threat features; The real-time decision-making layer is used to output a security event identification report based on global threat characteristics; The dynamic feedback layer is used to construct adversarial samples based on the input monitoring data, and continuously optimize the model parameters of the multimodal feature extraction layer, the cross-modal association layer, and the real-time decision layer based on the adversarial samples; the model parameters include model structure parameters and training hyperparameters; By introducing a dynamic feedback layer to construct adversarial samples for continuous optimization, and enhancing the model robustness through the least squares adversarial loss function, the security event recognition model has the ability to defend against adversarial attacks.

[0035] The formula of the loss function is: ; in, Represents the loss value of the loss function; Represents the feature reconstruction loss sub-function, which uses the mean square error function to ensure that the extracted features can restore the original input data as much as possible; Represents the feature alignment loss sub-function, which uses the contrast loss function to ensure that the features of different modalities are aligned in the semantic space; represents the cross-modal fusion loss sub-function, which uses the cross entropy loss function to measure the difference between the fused global threat features and the true label; Represents the feature decomposition loss subfunction, which uses the feature decomposition regularization loss function to ensure the effective separation of common features and unique features; It represents the classification loss sub-function, which uses the cross entropy loss function to measure the difference between the security event identification report output by the model and the actual event label; Represents the adversarial loss subfunction, which uses the least squares adversarial loss function to make the model more resistant to adversarial attacks; Both represent weight coefficients; as well as Both are used for optimization of multimodal feature extraction layers; as well as Both are used for optimization of cross-modal association layers; Optimization for real-time decision-making layer; Used for optimization of dynamic feedback layer; By setting the loss function to fuse six sub-loss functions and dynamically balancing the optimization objectives of each network layer through the λ coefficient, especially the introduction of the feature decomposition regularization term, the efficiency of cross-modal feature decoupling is effectively improved and the risk of overfitting is avoided.

[0036] By setting feature reconstruction loss, the integrity of feature extraction is guaranteed; by setting contrast loss, cross-modal consistency is improved; by setting adversarial loss, the model's anti-interference ability is enhanced; by setting decomposition regularization loss, overfitting is prevented; and by dynamic weight adjustment (λ1~λ6), different optimization objectives are flexibly balanced.

[0037] Highly realistic attack samples are generated through the least squares adversarial loss function, effectively improving the model's detection accuracy for unknown threats (such as zero-day vulnerabilities and APT attacks).

[0038] Step S2: Acquire historical monitoring data including at least network traffic data, log data, threat intelligence data, network device data, user behavior data, and social media data, and construct a data set after preprocessing and annotating each of the historical monitoring data; Step S3: Divide the data set into a training set, a validation set, and a test set, and use the training set, validation set, and test set to train, validate, and test the security event recognition model respectively; Step S4: performing knowledge distillation and deployment on the security event identification model that has passed the test; Step S5: Collect real-time monitoring data, pre-process the real-time monitoring data through the streaming computing engine, and then input it into the deployed security event identification model. The security event identification model outputs a security event identification report in the format of "event classification-confidence-associated device-handling suggestion"; During specific implementation, the streaming computing engine can be used to collect statistics such as attack volume, traffic, event type, etc., and the statistical data can be displayed on a visual interface in various styles such as graphs, maps, and timelines to intuitively present the security situation and improve user decision-making efficiency.

[0039] Step S6: Display the security incident identification report, the statistical data of the security incident identification report and the real-time monitoring data in real time through a visual interface.

[0040] Through multimodal feature fusion (integration of traffic, logs, intelligence, topology, behavior and semantic data) and cross-modal association mechanism (spatiotemporal alignment and hierarchical attention module), combined with dynamic feedback adversarial training to optimize model robustness, and using federated learning, genetic algorithms and ten-fold cross-validation to improve training efficiency and generalization ability, and based on evidence-based deep learning and GNNExplainer to achieve high-confidence, explainable real-time decision-making, finally through lightweight deployment of knowledge distillation and multi-dimensional visualization interface, a comprehensive, adaptive and real-time network security early warning system was built, which effectively improved threat detection accuracy, response speed and system anti-attack capability.

[0041] In step S1, the multimodal feature extraction layer is constructed based on a traffic time series encoding module, a log event encoding module, an intelligence map encoding module, a device topology encoding module, a behavior sequence encoding module, and a social text encoding module; The traffic time series encoding module is used to extract traffic time series features from the input network traffic data through a TCN network with void convolution; the log event encoding module is used to capture the causal relationship between log events from the input log data through a Bi-LSTM-CRF network to obtain log event features; Bi-LSTM-CRF is a deep learning model that combines a bidirectional long short-term memory network (Bi-LSTM) and a conditional random field (CRF), and is widely used in sequence labeling tasks in natural language processing, such as named entity recognition (NER), part-of-speech tagging (POS) and word segmentation; the intelligence graph encoding module is used to construct an intelligence knowledge graph for the input threat intelligence data through a GAT network, identify the entity relationships in the intelligence knowledge graph, and obtain intelligence graph features; the device topology encoding module It is used to learn the connection relationship between network devices from the input network device data through the GraphSAGE algorithm to obtain network topology features. The behavior sequence encoding module is used to capture the temporal dependency of user behavior from the input user behavior data through the Transformer-XL network to obtain user behavior features. Transformer-XL is an improved Transformer architecture designed to address the problems of context fragmentation and long dependencies in long sequence processing. The social text encoding module is used to extract deep semantic features of social media text from the input social media data through the BERT-wwm network, that is, to analyze relevant information on social media, such as sensitive information accidentally leaked by employees on social media. BERT-wwm (full name Bidirectional Encoder Representations from Transformers-Whole Word Masking) is a pre-trained language model optimized for Chinese natural language processing tasks. By building a six-modal parallel feature extraction network (multimodal feature extraction layer), TCN, Bi-LSTM-CRF, GAT, GraphSAGE, Transformer-XL, and BERT-wwm are used to differentially process heterogeneous data including network traffic data, log data, threat intelligence data, network device data, user behavior data, and social media data, thus breaking through the technical limitations of single-modal feature extraction; for example, the log event encoding module uses a Bi-LSTM-CRF network to capture causal relationships, which improves the event correlation recognition ability compared to traditional RNN models.

[0042] By integrating traffic time series, log events, intelligence graphs, network topology, user behavior and deep semantic features, it covers multi-dimensional information such as time, space, structure, behavior, and semantics for network threat detection; the TCN network processes traffic time series features to capture long-term dependencies, Bi-LSTM-CRF analyzes the causal chain of log events, the GAT network constructs a threat intelligence graph and strengthens entity relationship mining, GraphSAGE learns dynamic connections in network topology, Transformer-XL captures user behavior time series dependencies, BERT-wwm extracts deep semantics from social media, and then through spatiotemporal alignment (dynamic time warping) and hierarchical attention mechanism (self-attention + cross-attention + gated fusion), it achieves deep fusion of heterogeneous features, effectively improving the multimodal feature fusion capability.

[0043] By setting up a device association locator and adopting the GNNExplainer algorithm, the threat propagation path can be visualized and weak nodes can be located. For example, in APT attack detection, the lateral movement path from the border firewall to the internal host can be traced, providing a physical topology basis for security reinforcement and effectively improving the efficiency of operation and maintenance response.

[0044] The cross-modal association layer is constructed based on the spatiotemporal alignment module and the hierarchical attention module; The spatiotemporal alignment module is used to unify the time base of the input traffic time series features, log event features, intelligence map features, network topology features, user behavior features and deep semantic features through the dynamic time warping algorithm (DTW), and output them to the hierarchical attention module; the hierarchical attention module is constructed based on the intra-modal self-attention unit, the cross-modal cross-attention unit and the global gated attention unit; the intra-modal self-attention unit is used to extract local features from the traffic time series features, log event features, intelligence map features, network topology features, user behavior features and deep semantic features; the cross-modal cross-attention unit is used to extract global features from the traffic time series features, log event features, intelligence map features, network topology features, user behavior features and deep semantic features; the global gated attention unit is used to fuse local features and global features to output global threat features; By using the dynamic time warping algorithm through the cross-modal association layer to achieve spatiotemporal alignment, and combining it with the three-level attention mechanism (self-attention / cross-attention / gated attention) to achieve feature fusion, the key technical problem of spatiotemporal mismatch of multi-source data is solved. In particular, the feature weighted fusion method of the global gated attention unit effectively suppresses inter-modal noise interference.

[0045] The real-time decision layer is constructed based on an event classifier, a confidence evaluator, a device association locator, a disposal suggestion generator, and an output module; The event classifier uses a multi-label classification head with Focal Loss to identify and classify security events from global threat signatures, resulting in event classifications. This multi-label classification head with Focal Loss addresses class imbalance. The confidence estimator constructs an evidence deep learning framework and quantifies the confidence of security events calculated based on global threat signatures using Dirichlet distribution, quantifying epistemic uncertainty. The device association locator uses the GNNExplainer algorithm to trace threat propagation paths from global threat signatures and identify associated devices. The action suggestion generator generates action suggestions for security events corresponding to global threat signatures, optimizing the feasibility of defense strategies using a reinforcement learning framework. The reinforcement learning framework can be OpenAI Baselines or Stable Baselines3. The output module outputs a security event identification report in the format of "event classification - confidence - associated devices - action suggestion." The evidence deep learning framework combines evidence theory (such as the Dempster-Shafer theory) with deep learning techniques. It aims to improve the reliability and interpretability of decisions by quantifying the uncertainty of model predictions.

[0046] By adopting the evidence-based deep learning framework for confidence assessment and quantifying uncertainty through Dirichlet distribution, the credibility of the warning is effectively improved, which is significantly higher than the traditional SoftMax output method.

[0047] Through the four-dimensional output format of "event classification-confidence-associated equipment-handling suggestions", threat path tracing is achieved through the GNNExplainer algorithm, shortening the handling response time to minutes. Compared with the traditional output of only classification results, it effectively improves operation and maintenance efficiency.

[0048] The step S2 is specifically as follows: Acquire historical monitoring data including at least network traffic data, log data, threat intelligence data, network device data, user behavior data, and social media data; the network traffic data includes at least traffic size, traffic direction, traffic rate, traffic generation time, IP address, and protocol type; the log data includes at least server logs, security device logs, and user behavior logs; the server logs include at least system logs and application logs; the security device logs include at least firewall logs, intrusion detection logs, and antivirus software logs; the user behavior logs include at least login behavior and operation records; the threat intelligence data includes at least known attackers, known malware, and known vulnerabilities; the network device data includes at least operating status, configuration data, performance indicators, and connection relationships; the user behavior data includes at least login credentials, authentication requests, access frequency, access time, and access path; The historical monitoring data are pre-processed in sequence, including data cleaning, data analysis, data integration, data standardization, feature extraction, outlier processing, and missing value processing; the data cleaning at least includes removing invalid data, filtering noise data, and formatting; the data analysis at least includes structured data analysis, unstructured data analysis, and key information extraction; the data integration at least includes multi-source data integration, geographic information mapping, and time alignment; the data standardization at least includes feature standardization and data normalization; By using geographic information mapping and time alignment technology in the data preprocessing stage, the problem of unifying the spatiotemporal benchmarks of cross-regional data such as network device logs and user behavior trajectories has been solved; for example, the UTC time of the firewall log is converted to the local time zone and the time axis is calibrated with the user login behavior, effectively improving the accuracy of feature association.

[0049] By proposing a joint parsing method for structured / unstructured data and extracting key fields (such as IP addresses and vulnerability numbers) through regular expressions and NLP technology, we can achieve automated processing of non-standardized log data and reduce manual labeling costs.

[0050] The pre-processed historical monitoring data are labeled with at least security events, event classifications, associated devices, and disposal suggestions, and a data set is constructed based on the labeled historical monitoring data.

[0051] The step S3 is specifically as follows: Expanding the number of class-imbalanced samples in the dataset through a generative adversarial network; Divide the data set into ten equal data subsets, select one from each data subset as a validation set, select one as a test set, and use the remaining ones as training sets, until all the data subsets are traversed; By dividing the dataset into ten data subsets and adopting a rotating partitioning strategy (selecting the validation set, test set, and training set in turn), the stability verification of the security incident recognition model under different data distributions is ensured, local overfitting is avoided, and the generalization ability of the security incident recognition model in unknown environments is enhanced.

[0052] By adopting the generative adversarial network (GAN) to solve the class imbalance problem and combining it with the federated learning framework to protect data privacy, the generalization ability of the security event recognition model is effectively improved.

[0053] The security event recognition model is trained by calling the training set through a federated learning framework. During the training process, the hyperparameters of the security event recognition model, including at least a learning rate, a batch size, a number of iterations, a regularization parameter, and a weight constraint, are optimized through a genetic algorithm until the loss value of the loss function is less than a preset loss threshold or a preset early stopping condition is met; the early stopping condition is that the volatility of the recognition accuracy is less than 0.5% and the second-order derivative of the loss function curve approaches zero; By building a federated learning framework for distributed training and dynamically adjusting hyperparameters through genetic algorithms, the convergence speed of the security event recognition model is greatly improved and local optimal solutions are avoided. By dynamically adjusting hyperparameters such as the learning rate and batch size using genetic algorithms, combined with the early stopping conditions of the second-order derivative of the loss function approaching zero and the accuracy volatility <0.5%, overfitting is avoided and training efficiency is improved.

[0054] The trained security event recognition model is verified using the validation set to determine whether the recognition accuracy is greater than a preset accuracy threshold. If not, the verification fails and the training set is expanded to continue training. If so, the verification passes, and: The verified security event recognition model is tested using the test set to determine whether the F1 score is greater than a preset score threshold. If not, the test fails and the training set is expanded to continue training; if so, the test passes and the training ends.

[0055] The step S4 is specifically as follows: The tested security event recognition model is used as a teacher model to create a lightweight student model. A feature mapping relationship between the teacher model and the student model is established through a multi-head attention mechanism. A supervision loss function and a distillation loss function are set. A knowledge distillation operation is performed on the teacher model to train the student model until the supervision loss function and the distillation loss function converge. The student model obtained by the knowledge distillation operation is used as a compressed security event recognition model, and the compressed security event recognition model is deployed using containerization technology. The student model has fewer parameters and fewer network layers than the teacher model. The security incident recognition model is compressed through knowledge distillation, that is, through the teacher-student model architecture and multi-head attention feature mapping, the model is lightweight and the deployment resource requirements are effectively reduced.

[0056] In the context of knowledge distillation, minimizing the supervision loss and feature distillation loss are two key objectives in training a student model. Minimizing the supervision loss ensures that the student model can learn the correct output directly from the data, avoiding over-reliance on the teacher model. Feature distillation loss allows the student model to learn the intermediate feature representations of the teacher model, inheriting its generalization capabilities and semantic information.

[0057] The step S5 is specifically as follows: Collect real-time monitoring data, pre-process it through a streaming computing engine combined with multi-threading technology and load balancing technology, and then input it into the deployed security event identification model. The security event identification model outputs a security event identification report in the format of "event classification-confidence-associated device-handling recommendation"; A streaming computing engine is a computing platform used to process and analyze continuous data streams in real time. It can handle dynamic, infinite data streams and provide real-time analysis results before the value of the data decreases over time.

[0058] By combining a streaming computing engine with multi-threading technology, it achieves real-time processing capabilities of tens of thousands of data packets per second. Through a containerized deployment solution, it supports millisecond-level model updates to meet the real-time requirements of network security scenarios. Through containerization technology, the security event identification model and its operating environment can be packaged into a portable container to ensure operational consistency in different environments.

[0059] The step S6 is specifically as follows: Based on the security incident identification report, real-time statistics include at least the total number of security incidents, the total number of attacks today, the total number of event types, and the total number of associated devices; based on the real-time monitoring data, real-time statistics include at least the total inbound traffic today, the total outbound traffic today, the total number of visits today, and the ranking of attacking IP addresses of the all-in-one machine; Set a display style and display security event identification reports and statistical data in real time through a visual interface in the display style to provide visual early warning; the display style includes at least graphics, tables, maps, timelines and text lists.

[0060] A preferred embodiment of a network security incident visualization early warning system of the present invention includes the following modules: A security event identification model creation module is used to create a security event identification model based on the multimodal feature extraction layer, the cross-modal association layer, the real-time decision layer, and the dynamic feedback layer, and set the loss function of the security event identification model; The multimodal feature extraction layer is used to extract traffic time series features, log event features, intelligence graph features, network topology features, user behavior features and deep semantic features from the input monitoring data; The cross-modal association layer is used to fuse traffic time series features, log event features, intelligence graph features, network topology features, user behavior features, and deep semantic features to obtain global threat features; The real-time decision-making layer is used to output a security event identification report based on global threat characteristics; The dynamic feedback layer is used to construct adversarial samples based on the input monitoring data, and continuously optimize the model parameters of the multimodal feature extraction layer, the cross-modal association layer, and the real-time decision layer based on the adversarial samples; the model parameters include model structure parameters and training hyperparameters; By introducing a dynamic feedback layer to construct adversarial samples for continuous optimization, and enhancing the model robustness through the least squares adversarial loss function, the security event recognition model has the ability to defend against adversarial attacks.

[0061] The formula of the loss function is: ; in, Represents the loss value of the loss function; Represents the feature reconstruction loss sub-function, which uses the mean square error function to ensure that the extracted features can restore the original input data as much as possible; Represents the feature alignment loss sub-function, which uses the contrast loss function to ensure that the features of different modalities are aligned in the semantic space; represents the cross-modal fusion loss sub-function, which uses the cross entropy loss function to measure the difference between the fused global threat features and the true label; Represents the feature decomposition loss subfunction, which uses the feature decomposition regularization loss function to ensure the effective separation of common features and unique features; It represents the classification loss sub-function, which uses the cross entropy loss function to measure the difference between the security event identification report output by the model and the actual event label; Represents the adversarial loss subfunction, which uses the least squares adversarial loss function to make the model more resistant to adversarial attacks; Both represent weight coefficients; as well as Both are used for optimization of multimodal feature extraction layers; as well as Both are used for optimization of cross-modal association layers; Optimization for real-time decision-making layer; Used for optimization of dynamic feedback layer; By setting the loss function to fuse six sub-loss functions and dynamically balancing the optimization objectives of each network layer through the λ coefficient, especially the introduction of the feature decomposition regularization term, the efficiency of cross-modal feature decoupling is effectively improved and the risk of overfitting is avoided.

[0062] By setting feature reconstruction loss, the integrity of feature extraction is guaranteed; by setting contrast loss, cross-modal consistency is improved; by setting adversarial loss, the model's anti-interference ability is enhanced; by setting decomposition regularization loss, overfitting is prevented; and by dynamic weight adjustment (λ1~λ6), different optimization objectives are flexibly balanced.

[0063] Highly realistic attack samples are generated through the least squares adversarial loss function, effectively improving the model's detection accuracy for unknown threats (such as zero-day vulnerabilities and APT attacks).

[0064] A data set construction module is used to obtain historical monitoring data including at least network traffic data, log data, threat intelligence data, network device data, user behavior data, and social media data, and to construct a data set after preprocessing and annotating each of the historical monitoring data; A security event recognition model training module is used to divide the data set into a training set, a validation set, and a test set, and respectively use the training set, validation set, and test set to train, validate, and test the security event recognition model; A security event identification model deployment module, used to perform knowledge distillation and deployment on the security event identification model that has passed the test; A security event identification module is used to collect real-time monitoring data, pre-process the real-time monitoring data through a streaming computing engine, and then input it into a deployed security event identification model. The security event identification model outputs a security event identification report in the format of "event classification-confidence-associated device-treatment recommendation"; During specific implementation, the streaming computing engine can be used to collect statistics such as attack volume, traffic, event type, etc., and the statistical data can be displayed on a visual interface in various styles such as graphs, maps, and timelines to intuitively present the security situation and improve user decision-making efficiency.

[0065] The visual warning module is used to display the security incident identification report, the statistical data of the security incident identification report and the real-time monitoring data in real time through a visual interface.

[0066] Through multimodal feature fusion (integration of traffic, logs, intelligence, topology, behavior and semantic data) and cross-modal association mechanism (spatiotemporal alignment and hierarchical attention module), combined with dynamic feedback adversarial training to optimize model robustness, and using federated learning, genetic algorithms and ten-fold cross-validation to improve training efficiency and generalization ability, and based on evidence-based deep learning and GNNExplainer to achieve high-confidence, explainable real-time decision-making, finally through lightweight deployment of knowledge distillation and multi-dimensional visualization interface, a comprehensive, adaptive and real-time network security early warning system was built, which effectively improved threat detection accuracy, response speed and system anti-attack capability.

[0067] In the security event identification model creation module, the multimodal feature extraction layer is constructed based on the traffic time series coding module, the log event coding module, the intelligence map coding module, the device topology coding module, the behavior sequence coding module and the social text coding module; The traffic time series encoding module is used to extract traffic time series features from the input network traffic data through a TCN network with void convolution; the log event encoding module is used to capture the causal relationship between log events from the input log data through a Bi-LSTM-CRF network to obtain log event features; Bi-LSTM-CRF is a deep learning model that combines a bidirectional long short-term memory network (Bi-LSTM) and a conditional random field (CRF), and is widely used in sequence labeling tasks in natural language processing, such as named entity recognition (NER), part-of-speech tagging (POS) and word segmentation; the intelligence graph encoding module is used to construct an intelligence knowledge graph for the input threat intelligence data through a GAT network, identify the entity relationships in the intelligence knowledge graph, and obtain intelligence graph features; the device topology encoding module It is used to learn the connection relationship between network devices from the input network device data through the GraphSAGE algorithm to obtain network topology features. The behavior sequence encoding module is used to capture the temporal dependency of user behavior from the input user behavior data through the Transformer-XL network to obtain user behavior features. Transformer-XL is an improved Transformer architecture designed to address the problems of context fragmentation and long dependencies in long sequence processing. The social text encoding module is used to extract deep semantic features of social media text from the input social media data through the BERT-wwm network, that is, to analyze relevant information on social media, such as sensitive information accidentally leaked by employees on social media. BERT-wwm (full name Bidirectional Encoder Representations from Transformers-Whole Word Masking) is a pre-trained language model optimized for Chinese natural language processing tasks. By building a six-modal parallel feature extraction network (multimodal feature extraction layer), TCN, Bi-LSTM-CRF, GAT, GraphSAGE, Transformer-XL, and BERT-wwm are used to differentially process heterogeneous data including network traffic data, log data, threat intelligence data, network device data, user behavior data, and social media data, thus breaking through the technical limitations of single-modal feature extraction; for example, the log event encoding module uses a Bi-LSTM-CRF network to capture causal relationships, which improves the event correlation recognition ability compared to traditional RNN models.

[0068] By integrating traffic time series, log events, intelligence graphs, network topology, user behavior and deep semantic features, it covers multi-dimensional information such as time, space, structure, behavior, and semantics for network threat detection; the TCN network processes traffic time series features to capture long-term dependencies, Bi-LSTM-CRF analyzes the causal chain of log events, the GAT network constructs a threat intelligence graph and strengthens entity relationship mining, GraphSAGE learns dynamic connections in network topology, Transformer-XL captures user behavior time series dependencies, BERT-wwm extracts deep semantics from social media, and then through spatiotemporal alignment (dynamic time warping) and hierarchical attention mechanism (self-attention + cross-attention + gated fusion), it achieves deep fusion of heterogeneous features, effectively improving the multimodal feature fusion capability.

[0069] By setting up a device association locator and adopting the GNNExplainer algorithm, the threat propagation path can be visualized and weak nodes can be located. For example, in APT attack detection, the lateral movement path from the border firewall to the internal host can be traced, providing a physical topology basis for security reinforcement and effectively improving the efficiency of operation and maintenance response.

[0070] The cross-modal association layer is constructed based on the spatiotemporal alignment module and the hierarchical attention module; The spatiotemporal alignment module is used to unify the time base of the input traffic time series features, log event features, intelligence map features, network topology features, user behavior features and deep semantic features through the dynamic time warping algorithm (DTW), and output them to the hierarchical attention module; the hierarchical attention module is constructed based on the intra-modal self-attention unit, the cross-modal cross-attention unit and the global gated attention unit; the intra-modal self-attention unit is used to extract local features from the traffic time series features, log event features, intelligence map features, network topology features, user behavior features and deep semantic features; the cross-modal cross-attention unit is used to extract global features from the traffic time series features, log event features, intelligence map features, network topology features, user behavior features and deep semantic features; the global gated attention unit is used to fuse local features and global features to output global threat features; By using the dynamic time warping algorithm through the cross-modal association layer to achieve spatiotemporal alignment, and combining it with the three-level attention mechanism (self-attention / cross-attention / gated attention) to achieve feature fusion, the key technical problem of spatiotemporal mismatch of multi-source data is solved. In particular, the feature weighted fusion method of the global gated attention unit effectively suppresses inter-modal noise interference.

[0071] The real-time decision layer is constructed based on an event classifier, a confidence evaluator, a device association locator, a disposal suggestion generator, and an output module; The event classifier uses a multi-label classification head with Focal Loss to identify and classify security events from global threat signatures, resulting in event classifications. This multi-label classification head with Focal Loss addresses class imbalance. The confidence estimator constructs an evidence deep learning framework and quantifies the confidence of security events calculated based on global threat signatures using Dirichlet distribution, quantifying epistemic uncertainty. The device association locator uses the GNNExplainer algorithm to trace threat propagation paths from global threat signatures and identify associated devices. The action suggestion generator generates action suggestions for security events corresponding to global threat signatures, optimizing the feasibility of defense strategies using a reinforcement learning framework. The reinforcement learning framework can be OpenAI Baselines or Stable Baselines3. The output module outputs a security event identification report in the format of "event classification - confidence - associated devices - action suggestion." The evidence deep learning framework combines evidence theory (such as the Dempster-Shafer theory) with deep learning techniques. It aims to improve the reliability and interpretability of decisions by quantifying the uncertainty of model predictions.

[0072] By adopting the evidence-based deep learning framework for confidence assessment and quantifying uncertainty through Dirichlet distribution, the credibility of the warning is effectively improved, which is significantly higher than the traditional SoftMax output method.

[0073] Through the four-dimensional output format of "event classification-confidence-associated equipment-handling suggestions", threat path tracing is achieved through the GNNExplainer algorithm, shortening the handling response time to minutes. Compared with the traditional output of only classification results, it effectively improves operation and maintenance efficiency.

[0074] The dataset construction module is specifically used for: Acquire historical monitoring data including at least network traffic data, log data, threat intelligence data, network device data, user behavior data, and social media data; the network traffic data includes at least traffic size, traffic direction, traffic rate, traffic generation time, IP address, and protocol type; the log data includes at least server logs, security device logs, and user behavior logs; the server logs include at least system logs and application logs; the security device logs include at least firewall logs, intrusion detection logs, and antivirus software logs; the user behavior logs include at least login behavior and operation records; the threat intelligence data includes at least known attackers, known malware, and known vulnerabilities; the network device data includes at least operating status, configuration data, performance indicators, and connection relationships; the user behavior data includes at least login credentials, authentication requests, access frequency, access time, and access path; The historical monitoring data are pre-processed in sequence, including data cleaning, data analysis, data integration, data standardization, feature extraction, outlier processing, and missing value processing; the data cleaning at least includes removing invalid data, filtering noise data, and formatting; the data analysis at least includes structured data analysis, unstructured data analysis, and key information extraction; the data integration at least includes multi-source data integration, geographic information mapping, and time alignment; the data standardization at least includes feature standardization and data normalization; By using geographic information mapping and time alignment technology in the data preprocessing stage, the problem of unifying the spatiotemporal benchmarks of cross-regional data such as network device logs and user behavior trajectories has been solved; for example, the UTC time of the firewall log is converted to the local time zone and the time axis is calibrated with the user login behavior, effectively improving the accuracy of feature association.

[0075] By proposing a joint parsing method for structured / unstructured data and extracting key fields (such as IP addresses and vulnerability numbers) through regular expressions and NLP technology, we can achieve automated processing of non-standardized log data and reduce manual labeling costs.

[0076] The pre-processed historical monitoring data are labeled with at least security events, event classifications, associated devices, and disposal suggestions, and a data set is constructed based on the labeled historical monitoring data.

[0077] The security event identification model training module is specifically used to: Expanding the number of class-imbalanced samples in the dataset through a generative adversarial network; Divide the data set into ten equal data subsets, select one from each data subset as a validation set, select one as a test set, and use the remaining ones as training sets, until all the data subsets are traversed; By dividing the dataset into ten data subsets and adopting a rotating partitioning strategy (selecting the validation set, test set, and training set in turn), the stability verification of the security incident recognition model under different data distributions is ensured, local overfitting is avoided, and the generalization ability of the security incident recognition model in unknown environments is enhanced.

[0078] By adopting the generative adversarial network (GAN) to solve the class imbalance problem and combining it with the federated learning framework to protect data privacy, the generalization ability of the security event recognition model is effectively improved.

[0079] The security event recognition model is trained by calling the training set through a federated learning framework. During the training process, the hyperparameters of the security event recognition model, including at least a learning rate, a batch size, a number of iterations, a regularization parameter, and a weight constraint, are optimized through a genetic algorithm until the loss value of the loss function is less than a preset loss threshold or a preset early stopping condition is met; the early stopping condition is that the volatility of the recognition accuracy is less than 0.5% and the second-order derivative of the loss function curve approaches zero; By building a federated learning framework for distributed training and dynamically adjusting hyperparameters through genetic algorithms, the convergence speed of the security event recognition model is greatly improved and local optimal solutions are avoided. By dynamically adjusting hyperparameters such as the learning rate and batch size using genetic algorithms, combined with the early stopping conditions of the second-order derivative of the loss function approaching zero and the accuracy volatility <0.5%, overfitting is avoided and training efficiency is improved.

[0080] The trained security event recognition model is verified using the validation set to determine whether the recognition accuracy is greater than a preset accuracy threshold. If not, the verification fails and the training set is expanded to continue training. If so, the verification passes, and: The verified security event recognition model is tested using the test set to determine whether the F1 score is greater than a preset score threshold. If not, the test fails and the training set is expanded to continue training; if so, the test passes and the training ends.

[0081] The security event identification model deployment module is specifically used to: The tested security event recognition model is used as a teacher model to create a lightweight student model. A feature mapping relationship between the teacher model and the student model is established through a multi-head attention mechanism. A supervision loss function and a distillation loss function are set. A knowledge distillation operation is performed on the teacher model to train the student model until the supervision loss function and the distillation loss function converge. The student model obtained by the knowledge distillation operation is used as a compressed security event recognition model, and the compressed security event recognition model is deployed using containerization technology. The student model has fewer parameters and fewer network layers than the teacher model. The security incident recognition model is compressed through knowledge distillation, that is, through the teacher-student model architecture and multi-head attention feature mapping, the model is lightweight and the deployment resource requirements are effectively reduced.

[0082] In the context of knowledge distillation, minimizing the supervision loss and feature distillation loss are two key objectives in training a student model. Minimizing the supervision loss ensures that the student model can learn the correct output directly from the data, avoiding over-reliance on the teacher model. Feature distillation loss allows the student model to learn the intermediate feature representations of the teacher model, inheriting its generalization capabilities and semantic information.

[0083] The security event identification module is specifically used to: Collect real-time monitoring data, pre-process it through a streaming computing engine combined with multi-threading technology and load balancing technology, and then input it into the deployed security event identification model. The security event identification model outputs a security event identification report in the format of "event classification-confidence-associated device-handling recommendation"; A streaming computing engine is a computing platform used to process and analyze continuous data streams in real time. It can handle dynamic, infinite data streams and provide real-time analysis results before the value of the data decreases over time.

[0084] By combining a streaming computing engine with multi-threading technology, it achieves real-time processing capabilities of tens of thousands of data packets per second. Through a containerized deployment solution, it supports millisecond-level model updates to meet the real-time requirements of network security scenarios. Through containerization technology, the security event identification model and its operating environment can be packaged into a portable container to ensure operational consistency in different environments.

[0085] The visual warning module is specifically used for: Based on the security incident identification report, real-time statistics include at least the total number of security incidents, the total number of attacks today, the total number of event types, and the total number of associated devices; based on the real-time monitoring data, real-time statistics include at least the total inbound traffic today, the total outbound traffic today, the total number of visits today, and the ranking of attacking IP addresses of the all-in-one machine; Set a display style and display security event identification reports and statistical data in real time through a visual interface in the display style to provide visual early warning; the display style includes at least graphics, tables, maps, timelines and text lists.

[0086] In summary, the advantages of the present invention are: 1. Create a security event recognition model through the multimodal feature extraction layer, cross-modal association layer, real-time decision layer and dynamic feedback layer, and set the loss function of the security event recognition model; then obtain historical monitoring data including at least network traffic data, log data, threat intelligence data, network equipment data, user behavior data and social media data, pre-process and annotate each historical monitoring data to construct a data set; divide the data set into training set, validation set and test set, respectively use the training set, validation set and test set to train, verify and test the security event recognition model, and perform knowledge distillation and deployment on the security event recognition model that passes the test; then collect real-time monitoring data, pre-process the real-time monitoring data through the streaming computing engine, and input it into the deployed security event recognition model. The security event recognition model is output in the format of "event classification-confidence-associated device-handling suggestion" The security incident identification report displays the security incident identification report, security incident identification report and real-time monitoring data statistics in real time through a visual interface; that is, security incidents are identified through a pre-trained security incident identification model. The security incident identification model training process combines network traffic data, log data, threat intelligence data, network equipment data, user behavior data and social media data. Multi-dimensional data, combined with the dynamic feedback layer of the security incident identification model, is used to build adversarial samples for continuous optimization to ensure the accuracy of security incident identification; security incidents are automatically identified through the security incident identification model instead of traditional manual identification, and combined with the streaming computing engine, the efficiency of security incident identification is effectively improved; security incident identification reports and automatically counted statistics are displayed in real time through a visual interface, without the need to manually enter relevant warning information and statistics, which ultimately greatly improves the accuracy and timeliness of network security incident warnings.

[0087] 2. By building a six-modal parallel feature extraction network (multimodal feature extraction layer), TCN, Bi-LSTM-CRF, GAT, GraphSAGE, Transformer-XL, and BERT-wwm are used to differentially process heterogeneous data including network traffic data, log data, threat intelligence data, network device data, user behavior data, and social media data, thus overcoming the technical limitations of single-modal feature extraction. For example, the log event encoding module uses a Bi-LSTM-CRF network to capture causal relationships, which improves the ability to identify event correlations compared to traditional RNN models.

[0088] 3. The dynamic time warping algorithm is used to achieve spatiotemporal alignment through the cross-modal association layer, and feature fusion is achieved by combining the three-level attention mechanism (self-attention / cross-attention / gated attention). This solves the key technical problem of spatiotemporal mismatch of multi-source data. In particular, the feature weighted fusion method of the global gated attention unit effectively suppresses inter-modal noise interference.

[0089] 4. By introducing a dynamic feedback layer to construct adversarial samples for continuous optimization, and enhancing the model robustness through the least squares adversarial loss function, the security event recognition model has the ability to defend against adversarial attacks.

[0090] 5. By adopting the evidence deep learning framework for confidence assessment and quantifying uncertainty through Dirichlet distribution, the credibility of warnings is effectively improved, which is significantly higher than the traditional SoftMax output method.

[0091] 6. By building a federated learning framework for distributed training and dynamically adjusting hyperparameters through genetic algorithms, the convergence speed of the security event identification model is greatly improved and local optimal solutions are avoided. Using genetic algorithms to dynamically adjust hyperparameters such as the learning rate and batch size, combined with early stopping conditions such as the second-order derivative of the loss function approaching zero and the accuracy volatility of <0.5%, overfitting is avoided and training efficiency is improved.

[0092] 7. Through the four-dimensional output format of "event classification-confidence-associated devices-treatment recommendations", threat path tracing can be achieved through the GNNExplainer algorithm, shortening the treatment response time to minutes. Compared with the traditional method of only outputting classification results, it effectively improves operation and maintenance efficiency.

[0093] 8. By combining a streaming computing engine with multi-threading technology, it achieves real-time processing capabilities of tens of thousands of data packets per second. Through containerized deployment solutions, it supports millisecond-level model updates to meet the real-time requirements of network security scenarios. Through containerization technology, the security event identification model and its operating environment can be packaged into a portable container to ensure operational consistency in different environments.

[0094] 9. By setting the loss function to fuse six sub-loss functions and dynamically balancing the optimization objectives of each network layer through the λ coefficient, especially the introduction of the feature decomposition regularization term, the efficiency of cross-modal feature decoupling is effectively improved and the risk of overfitting is avoided.

[0095] 10. By using geographic information mapping and time alignment technology in the data preprocessing stage, the problem of unifying the spatiotemporal benchmarks of cross-regional data such as network device logs and user behavior trajectories has been solved; for example, the UTC time of the firewall log is converted to the local time zone and the time axis is calibrated with the user login behavior, effectively improving the accuracy of feature association.

[0096] 11. By proposing a joint parsing method for structured / unstructured data and extracting key fields (such as IP addresses and vulnerability numbers) through regular expressions and NLP technology, we can achieve automated processing of non-standardized log data and reduce manual labeling costs.

[0097] 12. By setting up a device association locator and using the GNNExplainer algorithm, the threat propagation path can be visualized and weak nodes can be located. For example, in APT attack detection, the lateral movement path from the border firewall to the internal host can be traced, providing a physical topology basis for security reinforcement and effectively improving the efficiency of operation and maintenance response.

[0098] 13. By integrating traffic time series, log events, intelligence graphs, network topology, user behavior and deep semantic features, it covers multi-dimensional information such as time, space, structure, behavior, and semantics for network threat detection; the TCN network processes traffic time series features to capture long-term dependencies, Bi-LSTM-CRF analyzes the causal chain of log events, the GAT network constructs a threat intelligence graph and strengthens entity relationship mining, GraphSAGE learns the dynamic connection of network topology, Transformer-XL captures the temporal dependencies of user behavior, BERT-wwm extracts the deep semantics of social media, and then through spatiotemporal alignment (dynamic time warping) and hierarchical attention mechanism (self-attention + cross-attention + gated fusion), it achieves deep fusion of heterogeneous features, effectively improving the multimodal feature fusion capability.

[0099] 14. By setting feature reconstruction loss, the integrity of feature extraction is guaranteed; by setting contrast loss, cross-modal consistency is improved; by setting adversarial loss, the model's anti-interference ability is enhanced; by setting decomposition regularization loss, overfitting is prevented; and by dynamic weight adjustment (λ1~λ6), different optimization objectives can be flexibly balanced.

[0100] 15. Generate highly realistic attack samples through the least squares adversarial loss function, effectively improving the model's detection accuracy for unknown threats (such as zero-day vulnerabilities and APT attacks).

[0101] 16. By dividing the dataset into ten data subsets and adopting a rotating partitioning strategy (selecting the validation set, test set, and training set in turn), the stability verification of the security event recognition model under different data distributions is ensured, local overfitting is avoided, and the generalization ability of the security event recognition model in unknown environments is enhanced.

[0102] 17. By adopting the generative adversarial network (GAN) to solve the class imbalance problem and combining it with the federated learning framework to protect data privacy, the generalization ability of the security event recognition model is effectively improved.

[0103] 18. The security incident recognition model is compressed through knowledge distillation, that is, through the teacher-student model architecture and multi-head attention feature mapping, the model is lightweight and the deployment resource requirements are effectively reduced.

[0104] 19. Through multimodal feature fusion (integration of traffic, logs, intelligence, topology, behavior and semantic data) and cross-modal association mechanism (spatiotemporal alignment and hierarchical attention module), combined with dynamic feedback adversarial training to optimize model robustness, and using federated learning, genetic algorithms and ten-fold cross-validation to improve training efficiency and generalization ability, and based on evidence-based deep learning and GNNExplainer to achieve high-confidence, explainable real-time decision-making, finally through lightweight deployment of knowledge distillation and multi-dimensional visualization interface, a comprehensive, adaptive and real-time network security early warning system was built, which effectively improved threat detection accuracy, response speed and system anti-attack capability.

[0105] Although the specific embodiments of the present invention are described above, those skilled in the art should understand that the specific embodiments described are merely illustrative and are not intended to limit the scope of the present invention. Equivalent modifications and changes made by those skilled in the art in accordance with the spirit of the present invention should be included within the scope of protection of the claims of the present invention.

Claims

1. A visual early warning method for network security incidents, characterized by: The steps include: Step S1: creating a security event recognition model based on the multimodal feature extraction layer, the cross-modal association layer, the real-time decision layer, and the dynamic feedback layer, and setting a loss function of the security event recognition model; Step S2: Acquire historical monitoring data including at least network traffic data, log data, threat intelligence data, network device data, user behavior data, and social media data, and construct a data set after preprocessing and annotating each of the historical monitoring data; Step S3: Divide the data set into a training set, a validation set, and a test set, and use the training set, validation set, and test set to train, validate, and test the security event recognition model respectively; Step S4: performing knowledge distillation and deployment on the security event identification model that has passed the test; Step S5: Collect real-time monitoring data, pre-process the real-time monitoring data through the streaming computing engine, and then input it into the deployed security event identification model. The security event identification model outputs a security event identification report in the format of "event classification-confidence-associated device-treatment recommendation"; Step S6: Display the security incident identification report, the security incident identification report and the statistical data of the real-time monitoring data in real time through a visual interface.

2. A network security incident visual early warning method according to claim 1, characterized in that: In step S1, the multimodal feature extraction layer is used to extract traffic time series features, log event features, intelligence map features, network topology features, user behavior features and deep semantic features from the input monitoring data; The cross-modal association layer is used to fuse traffic time series features, log event features, intelligence graph features, network topology features, user behavior features, and deep semantic features to obtain global threat features; The real-time decision-making layer is used to output a security event identification report based on global threat characteristics; The dynamic feedback layer is used to construct adversarial samples based on the input monitoring data, and continuously optimize the model parameters of the multimodal feature extraction layer, the cross-modal association layer, and the real-time decision layer based on the adversarial samples; The formula of the loss function is: ; in, Represents the loss value of the loss function; Represents the feature reconstruction loss sub-function, using the mean square error function; Represents the feature alignment loss sub-function, which adopts the contrast loss function; Represents the cross-modal fusion loss sub-function, using the cross entropy loss function; Represents the eigendecomposition loss subfunction, using the eigendecomposition regularized loss function; Represents the classification loss sub-function, using the cross entropy loss function; Represents the adversarial loss sub-function, using the least squares adversarial loss function; Both represent weight coefficients; as well as Both are used for optimization of multimodal feature extraction layers; as well as Both are used for optimization of cross-modal association layers; Optimization for real-time decision-making layer; Used for optimization of dynamic feedback layer; The multimodal feature extraction layer is constructed based on a traffic time series encoding module, a log event encoding module, an intelligence map encoding module, a device topology encoding module, a behavior sequence encoding module, and a social text encoding module; The traffic time series encoding module is used to extract traffic time series features from the input network traffic data through a TCN network with void convolution; the log event encoding module is used to capture the causal relationship between log events from the input log data through a Bi-LSTM-CRF network to obtain log event features; the intelligence graph encoding module is used to construct an intelligence knowledge graph for the input threat intelligence data through a GAT network, identify the entity relationships in the intelligence knowledge graph to obtain intelligence graph features; the device topology encoding module is used to learn the connection relationship between network devices from the input network device data through the GraphSAGE algorithm to obtain network topology features; the behavior sequence encoding module is used to capture the time dependency of user behavior from the input user behavior data through a Transformer-XL network to obtain user behavior features; the social text encoding module is used to extract deep semantic features of social media text from the input social media data through a BERT-wwm network; The cross-modal association layer is constructed based on the spatiotemporal alignment module and the hierarchical attention module; The spatiotemporal alignment module is used to unify the time base of the input traffic timing features, log event features, intelligence map features, network topology features, user behavior features and deep semantic features through a dynamic time warping algorithm, and output them to the hierarchical attention module; the hierarchical attention module is constructed based on the intra-modal self-attention unit, the cross-modal cross-attention unit and the global gated attention unit; the intra-modal self-attention unit is used to extract local features from the traffic timing features, log event features, intelligence map features, network topology features, user behavior features and deep semantic features; the cross-modal cross-attention unit is used to extract global features from the traffic timing features, log event features, intelligence map features, network topology features, user behavior features and deep semantic features; the global gated attention unit is used to fuse local features and global features to output global threat features; The real-time decision layer is constructed based on an event classifier, a confidence evaluator, a device association locator, a disposal suggestion generator, and an output module; The event classifier is used to identify and classify security events from global threat features through a multi-label classification head with Focal Loss to obtain event classification; the confidence evaluator is used to construct an evidence deep learning framework and calculate the confidence of security events based on global threat features through Dirichlet distribution quantification; the device association locator is used to trace the threat propagation path from global threat features through the GNNExplainer algorithm to obtain associated devices; the disposal suggestion generator is used to generate disposal suggestions for security events corresponding to global threat features; the output module is used to output a security event identification report in the format of "event classification-confidence-associated device-disposal suggestion".

3. The method for visualizing and warning network security events according to claim 1, wherein: The step S2 is specifically as follows: Acquire historical monitoring data including at least network traffic data, log data, threat intelligence data, network device data, user behavior data, and social media data; the network traffic data includes at least traffic size, traffic direction, traffic rate, traffic generation time, IP address, and protocol type; the log data includes at least server logs, security device logs, and user behavior logs; the server logs include at least system logs and application logs; the security device logs include at least firewall logs, intrusion detection logs, and antivirus software logs; the user behavior logs include at least login behavior and operation records; the threat intelligence data includes at least known attackers, known malware, and known vulnerabilities; the network device data includes at least operating status, configuration data, performance indicators, and connection relationships; the user behavior data includes at least login credentials, authentication requests, access frequency, access time, and access path; The historical monitoring data are pre-processed in sequence, including data cleaning, data analysis, data integration, data standardization, feature extraction, outlier processing, and missing value processing; the data cleaning at least includes removing invalid data, filtering noise data, and formatting; the data analysis at least includes structured data analysis, unstructured data analysis, and key information extraction; the data integration at least includes multi-source data integration, geographic information mapping, and time alignment; the data standardization at least includes feature standardization and data normalization; The pre-processed historical monitoring data are labeled with at least security events, event classifications, associated devices, and disposal suggestions, and a data set is constructed based on the labeled historical monitoring data.

4. The method for visualizing and warning network security events according to claim 1, wherein: The step S3 is specifically as follows: Expanding the number of class-imbalanced samples in the dataset through a generative adversarial network; Divide the data set into ten equal data subsets, select one from each data subset as a validation set, select one as a test set, and use the remaining ones as training sets, until all the data subsets are traversed; The security event recognition model is trained by calling the training set through a federated learning framework. During the training process, the hyperparameters of the security event recognition model, including at least a learning rate, a batch size, a number of iterations, a regularization parameter, and a weight constraint, are optimized through a genetic algorithm until the loss value of the loss function is less than a preset loss threshold or a preset early stopping condition is met; the early stopping condition is that the volatility of the recognition accuracy is less than 0.5% and the second-order derivative of the loss function curve approaches zero; The trained security event recognition model is verified using the validation set to determine whether the recognition accuracy is greater than a preset accuracy threshold. If not, the verification fails and the training set is expanded to continue training. If so, the verification passes, and: The verified security event recognition model is tested using the test set to determine whether the F1 score is greater than a preset score threshold. If not, the test fails and the training set is expanded to continue training; if so, the test passes and the training ends.

5. The method for visualizing and warning network security events according to claim 1, wherein: The step S4 is specifically as follows: The tested security event recognition model is used as a teacher model to create a lightweight student model. A feature mapping relationship between the teacher model and the student model is established through a multi-head attention mechanism. A supervision loss function and a distillation loss function are set. A knowledge distillation operation is performed on the teacher model to train the student model until the supervision loss function and the distillation loss function converge. The student model obtained by the knowledge distillation operation is used as a compressed security event recognition model, and the compressed security event recognition model is deployed using containerization technology. The step S5 is specifically as follows: Collect real-time monitoring data, pre-process it using a streaming computing engine combined with multi-threading and load balancing technologies, and then input it into the deployed security event identification model. The security event identification model outputs a security event identification report in the format of "event classification - confidence level - associated devices - disposal recommendations"; The step S6 is specifically as follows: Based on the security incident identification report, real-time statistics include at least the total number of security incidents, the total number of attacks today, the total number of event types, and the total number of associated devices; based on the real-time monitoring data, real-time statistics include at least the total inbound traffic today, the total outbound traffic today, the total number of visits today, and the ranking of attacking IP addresses of the all-in-one machine; Set a display style and display the security incident identification report and statistical data in real time through a visual interface in the display style; the display style includes at least graphics, tables, maps, timelines and text lists.

6. A network security incident visual early warning system, characterized by: Includes the following modules: A security event identification model creation module is used to create a security event identification model based on the multimodal feature extraction layer, the cross-modal association layer, the real-time decision layer, and the dynamic feedback layer, and set the loss function of the security event identification model; A data set construction module is used to obtain historical monitoring data including at least network traffic data, log data, threat intelligence data, network device data, user behavior data, and social media data, and to construct a data set after preprocessing and annotating each of the historical monitoring data; A security event recognition model training module is used to divide the data set into a training set, a validation set, and a test set, and respectively use the training set, validation set, and test set to train, validate, and test the security event recognition model; A security event identification model deployment module, used to perform knowledge distillation and deployment on the security event identification model that has passed the test; A security event identification module collects real-time monitoring data, pre-processes it through a streaming computing engine, and then feeds it into a deployed security event identification model. The model then outputs a security event identification report in the format of "event classification - confidence level - associated devices - disposal recommendations." The visual warning module is used to display the security incident identification report, the statistical data of the security incident identification report and the real-time monitoring data in real time through a visual interface.

7. A network security incident visual early warning system according to claim 6, characterized in that: In the security event identification model creation module, the multimodal feature extraction layer is used to extract traffic time series features, log event features, intelligence graph features, network topology features, user behavior features, and deep semantic features from the input monitoring data; The cross-modal association layer is used to fuse traffic time series features, log event features, intelligence graph features, network topology features, user behavior features, and deep semantic features to obtain global threat features; The real-time decision-making layer is used to output a security event identification report based on global threat characteristics; The dynamic feedback layer is used to construct adversarial samples based on the input monitoring data, and continuously optimize the model parameters of the multimodal feature extraction layer, the cross-modal association layer, and the real-time decision layer based on the adversarial samples; The formula of the loss function is: ; in, Represents the loss value of the loss function; Represents the feature reconstruction loss sub-function, using the mean square error function; Represents the feature alignment loss sub-function, which adopts the contrast loss function; Represents the cross-modal fusion loss sub-function, using the cross entropy loss function; Represents the eigendecomposition loss subfunction, using the eigendecomposition regularized loss function; Represents the classification loss sub-function, using the cross entropy loss function; Represents the adversarial loss sub-function, using the least squares adversarial loss function; Both represent weight coefficients; as well as Both are used for optimization of multimodal feature extraction layers; as well as Both are used for optimization of cross-modal association layers; Optimization for real-time decision-making layer; Used for optimization of dynamic feedback layer; The multimodal feature extraction layer is constructed based on a traffic time series encoding module, a log event encoding module, an intelligence map encoding module, a device topology encoding module, a behavior sequence encoding module, and a social text encoding module; The traffic time series encoding module is used to extract traffic time series features from the input network traffic data through a TCN network with void convolution; the log event encoding module is used to capture the causal relationship between log events from the input log data through a Bi-LSTM-CRF network to obtain log event features; the intelligence graph encoding module is used to construct an intelligence knowledge graph for the input threat intelligence data through a GAT network, identify the entity relationships in the intelligence knowledge graph to obtain intelligence graph features; the device topology encoding module is used to learn the connection relationship between network devices from the input network device data through the GraphSAGE algorithm to obtain network topology features; the behavior sequence encoding module is used to capture the time dependency of user behavior from the input user behavior data through a Transformer-XL network to obtain user behavior features; the social text encoding module is used to extract deep semantic features of social media text from the input social media data through a BERT-wwm network; The cross-modal association layer is constructed based on the spatiotemporal alignment module and the hierarchical attention module; The spatiotemporal alignment module is used to unify the time base of the input traffic timing features, log event features, intelligence map features, network topology features, user behavior features and deep semantic features through a dynamic time warping algorithm, and output them to the hierarchical attention module; the hierarchical attention module is constructed based on the intra-modal self-attention unit, the cross-modal cross-attention unit and the global gated attention unit; the intra-modal self-attention unit is used to extract local features from the traffic timing features, log event features, intelligence map features, network topology features, user behavior features and deep semantic features; the cross-modal cross-attention unit is used to extract global features from the traffic timing features, log event features, intelligence map features, network topology features, user behavior features and deep semantic features; the global gated attention unit is used to fuse local features and global features to output global threat features; The real-time decision layer is constructed based on an event classifier, a confidence evaluator, a device association locator, a disposal suggestion generator, and an output module; The event classifier is used to identify and classify security events from global threat features through a multi-label classification head with Focal Loss to obtain event classification; the confidence evaluator is used to construct an evidence deep learning framework and calculate the confidence of security events based on global threat features through Dirichlet distribution quantification; the device association locator is used to trace the threat propagation path from global threat features through the GNNExplainer algorithm to obtain associated devices; the disposal suggestion generator is used to generate disposal suggestions for security events corresponding to global threat features; the output module is used to output a security event identification report in the format of "event classification-confidence-associated device-disposal suggestion".

8. A network security incident visual early warning system according to claim 6, characterized in that: The dataset construction module is specifically used for: Acquire historical monitoring data including at least network traffic data, log data, threat intelligence data, network device data, user behavior data, and social media data; the network traffic data includes at least traffic size, traffic direction, traffic rate, traffic generation time, IP address, and protocol type; the log data includes at least server logs, security device logs, and user behavior logs; the server logs include at least system logs and application logs; the security device logs include at least firewall logs, intrusion detection logs, and antivirus software logs; the user behavior logs include at least login behavior and operation records; the threat intelligence data includes at least known attackers, known malware, and known vulnerabilities; the network device data includes at least operating status, configuration data, performance indicators, and connection relationships; the user behavior data includes at least login credentials, authentication requests, access frequency, access time, and access path; The historical monitoring data are pre-processed in sequence, including data cleaning, data analysis, data integration, data standardization, feature extraction, outlier processing, and missing value processing; the data cleaning at least includes removing invalid data, filtering noise data, and formatting; the data analysis at least includes structured data analysis, unstructured data analysis, and key information extraction; the data integration at least includes multi-source data integration, geographic information mapping, and time alignment; the data standardization at least includes feature standardization and data normalization; The pre-processed historical monitoring data are labeled with at least security events, event classifications, associated devices, and disposal suggestions, and a data set is constructed based on the labeled historical monitoring data.

9. A network security incident visual early warning system according to claim 6, characterized in that: The security event identification model training module is specifically used to: Expanding the number of class-imbalanced samples in the dataset through a generative adversarial network; Divide the data set into ten equal data subsets, select one from each data subset as a validation set, select one as a test set, and use the remaining ones as training sets, until all the data subsets are traversed; The security event recognition model is trained by calling the training set through a federated learning framework. During the training process, the hyperparameters of the security event recognition model, including at least a learning rate, a batch size, a number of iterations, a regularization parameter, and a weight constraint, are optimized through a genetic algorithm until the loss value of the loss function is less than a preset loss threshold or a preset early stopping condition is met; the early stopping condition is that the volatility of the recognition accuracy is less than 0.5% and the second-order derivative of the loss function curve approaches zero; The trained security event recognition model is verified using the validation set to determine whether the recognition accuracy is greater than a preset accuracy threshold. If not, the verification fails and the training set is expanded to continue training. If so, the verification passes, and: The verified security event recognition model is tested using the test set to determine whether the F1 score is greater than a preset score threshold. If not, the test fails and the training set is expanded to continue training; if so, the test passes and the training ends.

10. A network security incident visual early warning system according to claim 6, characterized in that: The security event identification model deployment module is specifically used to: The tested security event recognition model is used as a teacher model to create a lightweight student model. A feature mapping relationship between the teacher model and the student model is established through a multi-head attention mechanism. A supervision loss function and a distillation loss function are set. A knowledge distillation operation is performed on the teacher model to train the student model until the supervision loss function and the distillation loss function converge. The student model obtained by the knowledge distillation operation is used as a compressed security event recognition model, and the compressed security event recognition model is deployed using containerization technology. The security event identification module is specifically used to: Collect real-time monitoring data, pre-process it using a streaming computing engine combined with multi-threading and load balancing technologies, and then input it into the deployed security event identification model. The security event identification model outputs a security event identification report in the format of "event classification - confidence level - associated devices - disposal recommendations"; The visual warning module is specifically used for: Based on the security incident identification report, real-time statistics include at least the total number of security incidents, the total number of attacks today, the total number of event types, and the total number of associated devices; based on the real-time monitoring data, real-time statistics include at least the total inbound traffic today, the total outbound traffic today, the total number of visits today, and the ranking of attacking IP addresses of the all-in-one machine; Set a display style and display the security incident identification report and statistical data in real time through a visual interface in the display style; the display style includes at least graphics, tables, maps, timelines and text lists.

Images