Malicious instruction detection method and system fusing self-supervised learning and knowledge graph

Abstract

The invention discloses a malicious instruction detection method and system fusing self-supervised learning and a knowledge graph. The method comprises the steps of obtaining user instruction data and compliance labels, constructing an adversarial sample generation matrix, and generating an adversarial sample library through hierarchical variation and compliance correction; inputting the original instruction and the adversarial sample into a multi-modal detection model, wherein the model comprises a dual-channel encoder and a dynamic knowledge graph module; through a self-supervised comparison loss function optimization model, positive samples need to meet semantic and attack feature similarity threshold requirements, and negative samples are violation instructions; inputting a to-be-detected instruction into the trained model, extracting features, performing multi-hop reasoning on the features and the knowledge graph, and calculating a risk score; and when a malicious instruction is detected, generating a disposal strategy and updating the knowledge graph node. Through fusion of self-supervised learning and the dynamic knowledge graph, accurate detection is realized, the generalization ability and robustness of the model are enhanced, and the detection precision is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of the intersection of network security and data mining, and specifically to a malicious instruction detection method and system that integrates self-supervised learning and knowledge graphs. Background Art

[0002] In today's cybersecurity landscape, malicious command detection is a crucial component of ensuring system security. With the continuous evolution of cyberattack methods, traditional signature-based detection methods have become inadequate for combating new and evolving malware. To improve detection accuracy and efficiency, researchers have begun exploring behavioral analysis-based detection techniques. Machine learning and deep learning methods have garnered widespread attention due to their ability to automatically extract features from large amounts of data. However, these methods typically require large amounts of labeled data, and the labeling of malicious commands is both time-consuming and expensive, limiting their widespread adoption in practical applications.

[0003] As a structured semantic knowledge base, knowledge graphs can effectively organize and connect large amounts of information, providing a new perspective for understanding complex data. In the field of cybersecurity, knowledge graphs can be used to represent and infer malware behavior patterns, propagation pathways, and attacker behavioral characteristics. By combining knowledge graphs with machine learning technologies, the intelligence level of malicious command detection can be improved, enabling rapid response to unknown threats. However, how to effectively integrate knowledge graphs with machine learning models remains a pressing technical challenge.

[0004] Patent application CN119363426A discloses a knowledge graph-based network security early warning system, addressing the current shortage of existing knowledge graph-based network security early warning systems on the market, as well as issues such as low accuracy and lack of real-time performance. The system comprises a data preprocessing and knowledge extraction module, a knowledge graph construction and storage module, a threat detection and early warning analysis module, and an adaptive learning and update module. This system improves early warning accuracy: by constructing an accurate and comprehensive network security knowledge graph, the system can gain a deeper understanding of the relationships between network entities and attack patterns, thereby improving the accuracy of early warnings.

[0005] Self-supervised learning, a machine learning paradigm that requires little or no labeled data, has made significant progress in recent years in fields such as image recognition and natural language processing. By designing appropriate pre-training tasks, self-supervised learning enables models to learn rich feature representations from unlabeled data, providing a new approach to addressing the data labeling challenge in malicious command detection. However, applying self-supervised learning to cybersecurity, particularly in conjunction with knowledge graphs for malicious command detection, requires further research and development. Summary of the Invention

[0006] The present invention aims to overcome the shortcomings of existing technologies by providing a method and system for detecting malicious commands that integrates self-supervised learning and knowledge graphs. Traditional malicious command detection methods have limited accuracy when faced with complex and varied malicious commands, making it difficult to accurately identify malicious commands. This present invention effectively improves the detection accuracy of malicious commands by constructing an adversarial sample generation matrix and utilizing layered mutation and compliance correction techniques to generate an adversarial sample library.

[0007] The object of the present invention is achieved through the following technical solutions:

[0008] A malicious instruction detection method that integrates self-supervised learning and dynamic knowledge graphs includes the following:

[0009] S1: Obtain user instruction data and corresponding compliance labels, construct an adversarial sample generation matrix, and generate an adversarial sample library through layered mutation and compliance correction;

[0010] S2: Input the original instruction and the adversarial sample into a multimodal detection model, which includes a dual-channel encoder and a dynamic knowledge graph module;

[0011] S3: Optimize the model using a self-supervised contrastive loss function. Positive samples must have semantic similarity above a threshold and attack signature similarity below a threshold. Negative samples are instructions that violate predefined rules.

[0012] S4: Input the instructions to be detected into the trained model, extract the instruction features and perform multi-hop reasoning with the knowledge graph to calculate the risk score; when malicious instructions are detected, generate a disposal strategy including blocking actions and legal basis, and dynamically update the knowledge graph nodes.

[0013] This invention improves the accuracy and robustness of malicious command detection. By constructing an adversarial sample generation matrix and generating a library of adversarial samples, this method can simulate malicious user behavior, enabling the detection model to learn more malicious command characteristics during training, thereby improving detection accuracy. Furthermore, the introduction of adversarial samples enhances the robustness of the model, enabling it to better cope with attacks from various malicious commands.

[0014] As a preferred method, the construction of the adversarial sample generation matrix in S1 specifically includes:

[0015] Define the dimensional mutation parameter space, including lexical perturbation intensity, risk threshold, and resource consumption constraints;

[0016] Adopting a hierarchical mutation strategy, it sequentially performs Unicode character replacement, syntax tree reorganization, and semantic equivalence conversion;

[0017] Generate samples based on real-time corrections to the knowledge graph, replacing high-risk keywords with compliant expressions.

[0018] As a preferred embodiment, the dual-channel encoder in S2 includes:

[0019] Instruction encoding channel: injecting compliant positional encoding into the RoBERTa model;

[0020] Context encoding channel: It adopts a structure combining dilated convolution and BiLSTM, and introduces a time decay factor to enhance the recency effect.

[0021] As a preferred embodiment, the self-supervised contrast loss function in S3 is L = γ·L_contrast+(1-γ)·L_legal, where:

[0022] L_contrast uses InfoNCE loss; L_legal is a multi-label cross entropy loss that calculates the probability of violation of instructions and rules.

[0023] As a preferred method, the updating of the dynamic knowledge graph in S4 includes:

[0024] Collect threat intelligence and compliance clauses in real time, and build a graph that includes attack technique and tactics nodes, legal clause nodes, and time-space relationships;

[0025] When a new attack is detected, a correlation subgraph is created and the risk propagation value is calculated;

[0026] If the subgraph risk value exceeds the threshold, the graph node weight is dynamically adjusted.

[0027] As a preferred method, the multi-hop reasoning of the knowledge graph specifically includes:

[0028] Path pruning: terminate the search when the cumulative risk value is <0.1;

[0029] Parallel computing: Use thread pool to simultaneously process all attack paths within 3 hops.

[0030] As a preferred embodiment, the generation of the treatment strategy in S4 includes:

[0031] Align clauses: Match specific compliance items that have been violated from the knowledge graph and generate clause reference chains;

[0032] Generate visual reports: Display attack path maps and corresponding legal basis, supporting attack tracing and compliance auditing.

[0033] As a preferred method, the online update method of the model includes:

[0034] When the number of new nodes in the knowledge graph exceeds the capacity threshold, incremental model fine-tuning is initiated;

[0035] Adopt an elastic weight solidification strategy, keep compliance / legal-related parameters unchanged, and only update the attack pattern detection layer parameters.

[0036] A malicious command detection system that integrates self-supervised learning and dynamic knowledge graphs, including:

[0037] The data adversarial module is used to generate a library of compliant adversarial samples, including a hierarchical mutation unit and a compliant correction unit;

[0038] Multimodal detection module, including a dual-channel encoder and a dynamic knowledge graph engine;

[0039] The self-supervised training module uses contrastive loss and loss to jointly optimize model parameters, where positive samples meet the dual thresholds of semantic similarity and attack difference;

[0040] The dynamic decision module is used to calculate the instruction risk score, generate a disposal strategy containing the basis, and update the knowledge graph node.

[0041] As a preferred embodiment, the dynamic decision module includes:

[0042] The multi-hop reasoning unit uses a parallel thread pool to process attack paths within 3 hops and implements a path pruning strategy. The visual report generation unit maps attack paths and legal clauses into an interactive graph to support traceability auditing.

[0043] The present invention has at least the following beneficial effects: By integrating self-supervised learning and dynamic knowledge graphs, it achieves efficient and accurate detection of malicious commands. By constructing an adversarial sample generation matrix and utilizing layered mutation and compliance correction techniques to generate an adversarial sample library, the model's generalization and robustness are effectively enhanced, thereby improving the accuracy of malicious command detection. DETAILED DESCRIPTION

[0044] In this disclosure, terms are used to illustrate specific embodiments and do not constitute limitations of this disclosure. In this context, the use of the singular also encompasses the plural, unless the text clearly indicates otherwise. In the process of explanation, it should be understood that terms such as "including" or "having" are intended to indicate the presence of a feature, quantity, step, operation, structural component, part, or combination thereof, and do not preclude the possibility or addition of one or more other features, quantities, steps, operations, structural components, parts, or combinations thereof.

[0045] It should be understood that while the following description provides extensive specific details intended to facilitate a comprehensive understanding of the example embodiments, those skilled in the art will appreciate that the example embodiments can be implemented without these specific details. For example, systems may be presented in block diagram form to avoid excessive detail that would obscure the clarity of the examples. In other cases, unnecessary details regarding well-known processes, structures, and techniques may be omitted to maintain clarity of the examples.

[0046] A malicious instruction detection method that integrates self-supervised learning and dynamic knowledge graphs includes the following:

[0047] S1: Obtain user instruction data and corresponding legal compliance labels, construct an adversarial sample generation matrix, and generate an adversarial sample library through layered mutation and compliance correction;

[0048] S2: The original instructions and adversarial examples are fed into a multimodal detection model, which includes a dual-channel encoder and a dynamic knowledge graph module. The instruction encoding channel incorporates legal position encoding, the context encoding channel employs spatiotemporal decay convolution, and the dynamic knowledge graph correlates attack patterns with compliance / legal provisions in real time.

[0049] S3: Optimize the model using a self-supervised contrastive loss function. Positive samples must have a semantic similarity above a threshold (e.g., >0.8) and attack signature similarity below a threshold (e.g., <0.2). Negative samples are instructions that violate predefined rules or legal constraints.

[0050] S4: Input the instructions to be detected into the trained model, extract the instruction features and perform multi-hop reasoning with the knowledge graph to calculate the risk score; when malicious instructions are detected, generate a disposal strategy including blocking actions and legal basis, and dynamically update the knowledge graph nodes.

[0051] This embodiment provides a malicious instruction detection system from data construction, model training to decision-making and disposal. First, various user operation instructions (such as database queries, API calls) are collected, and each instruction is marked to see whether it complies with GDPR, Cybersecurity Law and other regulatory requirements. Based on these raw data, a three-layer mutation strategy is used to generate adversarial samples. Character layer: Use Unicode special characters to replace key letters (such as "SELECT" becomes At the syntax level, this involves restructuring the command structure (inserting redundant parentheses in SQL statements); and at the semantic level, this involves converting high-risk operations into compliant expressions (changing "DELETE" to "Secure Erase"). During the generation process, real-time access to the rules / legal knowledge graph automatically replaces sensitive terms that may violate regulations or rules, creating a training sample library that retains attack signatures while meeting compliance requirements.

[0052] Multi-dimensional feature analysis builds a dual-channel detection model to simultaneously process instructions. Instruction parsing channel: Embeds a legal or rule-focused mechanism into the pre-trained language model (RoBERTa), enabling the model to focus on analyzing compliance-sensitive points such as data deletion and unauthorized access. Context analysis channel: Utilizes a convolutional neural network with time-decay characteristics to capture recent high-frequency abnormal instruction patterns (such as intensive permission queries within a short period of time). Dynamic knowledge graphs provide simultaneous support, mapping instruction features to known attack methods (such as SQL injection and unauthorized traversal) and their associated legal clause nodes in real time.

[0053] Comparative model training uses a designed training mechanism to improve detection accuracy. Positive sample pairs are selected with semantic similarity >80% but attack signature similarity <20% (e.g., a standard query vs. an injection attack). Negative samples are constructed with clearly illegal instructions (e.g., a full table scan request containing the "*" wildcard). Through comparative learning, the model is forced to grasp the essential characteristics of the attack (e.g., unusual parameter concatenation) rather than memorize the specific surface form of the instructions. Compliance penalties are also implemented to ensure the model understands regulatory red lines such as "unauthorized access to user privacy data."

[0054] Intelligent decision-making and knowledge evolution, with multi-level judgments used in the detection phase. The system extracts the key features of instructions (request parameters, access objects), traces three layers of relationships (instructions, attack methods, exploits, and legal clauses) in the knowledge graph, and comprehensively calculates the technical risk value (attack success rate) and the legal risk value (penalty severity). When high-risk instructions are detected, the system automatically generates a disposal plan. Technical level: Immediately terminate the request and isolate the process. Legal level: Output the basis for the violation (such as Article 31 of the Data Security Law). At the same time, new attack features are synchronously updated to the knowledge graph to form a continuously evolving defense system.

[0055] Through the design of data generation, feature analysis, comparative learning, and decision evolution, the entire method not only solves the problem of poor adaptability of traditional methods to new attacks, but also achieves a deep integration of technical detection and legal compliance. It is particularly suitable for security protection in highly regulated scenarios such as finance and government affairs.

[0056] This embodiment provides an intelligent method for identifying and handling malicious instructions. Its core process is divided into four progressive stages. First, the system automatically generates a large number of training samples that closely resemble real-world attack signatures by analyzing historical instruction data. These samples, while maintaining the original instruction semantics, simulate different attack methods through character replacement and grammatical reorganization, and are automatically corrected to legal expressions, forming a training library for attack and defense. Next, a detection model is constructed with two analysis channels: one channel focuses on parsing the grammatical and semantic features of the instruction itself, and the other channel analyzes the context in which the instruction is executed. This model is then combined with a dynamically updated knowledge graph (covering the latest associations between attack methods and legal provisions) for joint analysis. During the model training phase, a comparative learning strategy is employed: the model is required to accurately identify variant instructions with similar semantics but different attack methods (positive samples), while distinguishing malicious instructions that clearly violate security rules or legal provisions (negative samples). Finally, during actual detection, the system not only determines the instruction risk level but also uses the knowledge graph to trace the legal basis for the attack. It automatically generates a response report containing technical interception solutions and regulatory references, and updates the knowledge base in real time to address new attack methods. The entire process implements management from attack feature learning, legal clause association to disposal decision generation.

[0057] In a preferred embodiment, the construction of the adversarial sample generation matrix in S1 specifically includes:

[0058] A 12-dimensional mutation parameter space is defined, including lexical perturbation intensity, legal risk threshold, and resource consumption constraints. Specifically, these can be Unicode replacement rate, homograph ratio, syntax tree depth variation coefficient, context retention, semantic equivalence conversion threshold, legal clause matching, GPU memory usage limit, generation time threshold, legal risk threshold, clause violation detection sensitivity, generation batch dynamic adjustment factor, and mutation intensity attenuation factor.

[0059] Adopting a hierarchical mutation strategy, it sequentially performs Unicode character replacement, syntax tree reorganization, and semantic equivalence conversion;

[0060] Generate samples based on legal or regulatory knowledge graphs in real time, replacing high-risk keywords with compliant expressions.

[0061] The construction process of the adversarial sample generation matrix is divided into three core steps. A control system with 12 adjustable parameters is set up to perform three-level progressive sample transformation: in the first step, character-level interference is carried out (for example, replacing the letter "o" with the similar-looking Greek letter "ο"), in the second step, the instruction syntax structure is reorganized (the code execution order is adjusted without changing the function), and in the third step, semantic substitution is carried out (changing "delete user data" to "anonymization process"). During all mutation processes, the legal knowledge base is called in real time by the system to automatically detect and replace high-risk words that may violate privacy protection regulations (for example, correcting "export all" to "export within the authorized scope") to ensure that the generated adversarial samples not only retain the attack characteristics but also meet compliance requirements, providing high-quality attack and defense data for model training.

[0062] In a preferred embodiment, the dual-channel encoder in S2 includes:

[0063] Instruction encoding channel: Inject compliance / legal position encoding into the RoBERTa model, and the calculation formula is:

[0064]

[0065] where pos represents the absolute position of the current token in the input sequence, LegalSim(pos) is a position-sensitive legal clause correlation calculation function, α is the legal correlation adjustment coefficient (the recommended initial value is 0.05 - 0.2), i is the dimension index of the position encoding vector (the value range: 0 ≤ i < d / 2), and d is the dimension size of the position encoding.

[0066]

[0067] where, w pos is the embedding vector of the token corresponding to the position pos, c k is the feature vector of the k-th legal clause node in the knowledge graph, GAT() is the graph attention network to calculate the correlation weight, and Z is the normalization factor (which can take the weight sum of the top-3 correlated clauses).

[0068] Context Encoding Channel: This architecture combines dilated convolution with BiLSTM, and introduces a time decay factor to enhance the recency effect. The dilated convolution and BiLSTM work together to capture spatial features. An observation system is constructed by multiplying convolution windows layer by layer. The bottom-level convolution (small window) captures syntax anomalies between adjacent instructions (such as consecutive privilege escalation commands). The middle-level window identifies attack chains spanning 5-10 instructions (such as associated login, probing, and penetration). The high-level window scans for global behavioral patterns (such as monthly peaks in data export). Intermittent sampling (holes) disrupts attacker-inserted interfering instructions, allowing for effective identification even when malicious code is interspersed with harmless operations. Temporal Correlation Parsing (BiLSTM) employs bidirectional causal reasoning to analyze the temporal evolution of attack execution (from vulnerability exploitation to actual intrusion) and to trace the attack source backwards (such as inferring the initial penetration point from data theft). Context penetration overcomes the limitations of traditional one-way models and can identify phishing attack patterns, such as malicious instructions interspersed within normal operations. For example, the command sequence detected was: logging into the system, viewing logs, elevating permissions, and accessing the database. The dilated convolution algorithm discovered an unconventional correlation between "elevating permissions" and the previous and subsequent commands. The BiLSTM reverse analysis revealed that the "viewing logs" operation did not follow the daily operation and maintenance process. The comprehensive judgment was that it was an unauthorized attack disguised as daily maintenance.

[0069] The time decay factor strengthens recent events, while dynamic weight adjustment exponentially decays the weight value over time. The time decay factor dynamically adjusts the weight of historical events, focusing the model on the most recently occurring suspicious operations. This function is similar to the forgetting curve of human memory: recent experiences are more vivid, while distant events gradually fade, but encountering key clues suddenly reawakens relevant memories. The influence of events decreases exponentially over time, and the decay rate is automatically adjusted based on system load. For example, in normal mode, the weight decreases by 63% per hour; in threat mode, the decay rate decreases by 50% when signs of an attack are detected. To enhance sudden response, a density trigger mechanism is used. When the number of similar operations per unit time exceeds a threshold (e.g., 5 times / minute), the decay limit is automatically lifted. For example, when frequent password cracking attempts are detected, all login records within a 12-hour period are fully reviewed. Upon detection of a high-risk operation, the weight of the operations 30 minutes before and after it is automatically increased. Bidirectional weight injection is implemented. Forward propagation introduces a decay factor in the forget gate of the LSTM to control the strength of historical memory retention; backward propagation assigns a higher learning rate to recent data during gradient updates.

[0070] The context encoding channel captures multi-scale spatiotemporal features of attack behavior. A multi-level dilated convolutional architecture builds a progressive observation field of view: the first layer identifies local anomalies between adjacent instructions (e.g., consecutive privilege escalation operations), the second layer captures mid-range attack chains spanning 5-10 instructions (e.g., associated login, probing, and penetration actions), and the third layer scans for global behavioral patterns (e.g., data exfiltration attempts occurring at fixed monthly intervals). This architecture acts like a surveillance system with a zoom lens, enabling both detailed observations and the overall rhythm of attacks.

[0071] Bidirectional causal reasoning uses a bidirectional recurrent neural network to simultaneously analyze the instruction stream: forward parsing the temporal evolution of the attack (from vulnerability detection to actual intrusion) and backward tracing the attack's source back to its anomalous starting point (e.g., inferring the initial penetration point from data theft). This bidirectional mechanism can identify disguised attack behaviors, such as "phishing attacks" where malicious instructions are interspersed with normal operations.

[0072] A time-decay factor is introduced to establish an intelligent memory mechanism: similar operations occurring within 30 minutes are given the highest weight (e.g., frequent password attempts). Similar actions from an hour ago are automatically attenuated (e.g., by 60%), and historical operations older than three hours are retained for only basic reference. The system provides real-time security situation awareness, improving response times when detecting sudden zero-day attacks.

[0073] When attackers adopt a low-frequency and slow infiltration strategy, the system discovers quarterly regular login anomalies through high-level void convolution, and two-way analysis dismantles the privilege escalation operation chain disguised as routine maintenance. The time decay mechanism strengthens the monitoring weight of abnormal logins in the last two hours, and ultimately triggers the "Cybersecurity Law" compliance alert before data leakage.

[0074] In a preferred embodiment, the self-supervised contrast loss function described in S3 is L = γ·L_contrast+(1-γ)·L_legal, where L is the total loss and γ is the loss balance factor, which controls the weight distribution ratio of contrast loss and legal loss. L_contrast (contrast loss) adopts InfoNCE loss (noise contrast estimation loss), and the positive sample construction satisfies sim_semantic (semantic similarity)>0.8 and attack_sim (attack feature similarity)<20%; L_legal is the multi-label cross entropy loss (legal compliance loss), which calculates the violation probability of instructions and compliance / legal clauses. Multi-label cross entropy loss is used to handle scenarios where a sample may be associated with multiple legal clauses at the same time, and the model needs to independently predict the violation probability for each relevant legal clause.

[0075] The joint loss function of this embodiment realizes the dual-driven learning of technical features and legal knowledge. Attack essential feature learning (contrastive loss) forces the model to penetrate the superficial changes of the attack by constructing special positive sample pairs. Positive sample requirements: semantic similarity>80% (to ensure the consistency of the core intention of the instruction), attack feature similarity<20% (such as mutating SQL injection into XSS attack). Enable the model to identify "different variants of homologous attacks", such as identifying the essential risk consistency of "deleting user tables" and "clearing user data". Strengthen legal boundaries (legal losses) and build a multi-dimensional compliance detection system. Detect multiple legal clauses that the instructions may violate, output the violation probability value of each legal clause, and trigger the disposal mechanism when the violation probability of any clause is>60%.

[0076] Collaborative training strategy: Initial stage (γ=0.8): Focus on attack feature learning and quickly establish basic detection capabilities. Later stage (γ=0.3): Strengthen legal constraints and accurately identify gray area behaviors that are "technically legal but operationally illegal". For example, the positive sample pair: "SELECT * FROM users" (normal query) and " *FROM users WHERE 1=1" (SQL injection) (similar semantics but different attack signatures, attack signature similarity <0.2). When "Export all customer data" is detected, the model must simultaneously determine whether it violates the Measures for the Administration of Cross-Border Data Transmission and the Cybersecurity Law. This dual loss approach enables the model to understand the evolution of attack techniques (comparative loss drivers) and establish a quantitative understanding of legal red lines (legal loss constraints), ultimately achieving an organic integration of technical detection and compliance review.

[0077] In a preferred embodiment, the updating of the dynamic knowledge graph in S4 includes:

[0078] Collect threat intelligence and compliance clauses in real time, and build a graph that includes attack technique and tactics nodes, legal clause nodes, and time-space relationships;

[0079] When a new attack is detected, a correlation subgraph is created and the risk propagation value is calculated. Where δ is the attenuation factor, such as 0.6, i is the level number, the first level, i=1. i is the original risk value of the i-th layer, R path is the comprehensive risk value of the path, which is the total risk after the attack propagates through the associated nodes.

[0080] If the subgraph risk value exceeds the threshold, the graph node weight is dynamically adjusted, and the update formula is w1=threat level ·(1-α·R path ), α is the adjustment factor, R pathIt needs to be normalized to [0,1] (e.g., normalized by the maximum historical risk value), w1 is the updated node weight, the dynamically adjusted threat node weight, which is used for risk propagation calculation in the knowledge graph, threat level It is the original threat level, the initial threat value of the node based on historical data statistics, and its value range is [0,1] (a real number greater than or equal to 0 and less than or equal to 1).

[0081] A dynamic knowledge graph update mechanism enables the self-evolution of security defense capabilities. Multi-source intelligence is integrated in real time, continuously capturing threat intelligence such as cyberattack tool transaction records and vulnerability exploitation trends, while also integrating newly released compliance regulations (such as GDPR revisions). This information is structured into four types of nodes within the knowledge graph: attack technique and tactic nodes (such as "supply chain poisoning" and "zero-day vulnerability exploitation"), legal clause nodes (such as certain provisions of the Data Security Law), spatiotemporal relationships (the time the attack was first discovered and the geographical spread path), and association relationships (the correspondence between a particular attack technique and a specific legal provision). New attack correlation analysis: When an unknown attack technique is detected (such as phishing code generated using AI), a subgraph is constructed to automatically associate the attack with known nodes (such as the "social engineering attack" technique and tactic node). Risk propagation assessment: This analyzes the three layers of associated nodes that the attack may impact. Directly associated nodes (the first layer) are defined as knowledge graph nodes directly related to the new attack (such as the vulnerability exploited or the malicious tools used). The risk value is 100% (completely inheriting the original risk of the attack). Indirectly associated nodes (second layer) are defined as nodes indirectly associated through first-layer nodes (e.g., attack groups previously implicated in the vulnerability, historical attack incidents). The risk value is: original risk value x 60% (i.e., 40% attenuation). Peripherally associated nodes (third layer) are defined as nodes further associated through second-layer nodes (e.g., other vulnerabilities previously exploited by attack groups, relevant legal provisions). The risk value is: second-layer risk value x 60% (cumulative attenuation of 64%).

[0082] In a preferred embodiment, the multi-hop reasoning of the knowledge graph specifically includes:

[0083] Path pruning: When the cumulative risk value R path The search is terminated when <0.1;

[0084] Parallel computing: Use a thread pool to simultaneously process all attack paths within 3 hops and aggregate risk scores:

[0085]

[0086] Among them, R tech Score the technical risk, R legal is the legal risk score, θ is the dynamic threshold, c1 and c2 are weight coefficients, which are preset to 0.7 and 0.3 (technology first), and can be dynamically calibrated.final It is a comprehensive score of technical and legal risks.

[0087] When analyzing attack paths, the system automatically ignores low-risk paths. When the cumulative risk value of a path is lower than 0.1 (such as ordinary log queries, regular data access, and other operations), in-depth tracking of the path is immediately stopped. Doing so can reduce a lot of invalid calculations and concentrate resources on analyzing high-risk paths (such as unauthorized operations, batch data exports, etc.). Parallel computing uses multi-threaded concurrent analysis of all attack paths within 3 steps and generates a comprehensive risk score. The attack path is broken down into 3 key steps (such as intrusion points, vulnerability exploitation, and data theft). At the same time, the technical hazards (such as the difficulty of vulnerability exploitation) and the degree of legal violations (such as violations of Article * of the "Data Security Law") are calculated. Parallel computing analyzes the 3-step path simultaneously to identify key threat nodes. Comprehensive score: Technical hazards (such as 0.9) plus legal risks (such as 0.95) will trigger a high-risk alarm and generate disposal recommendations.

[0088] This embodiment's path pruning significantly reduces low-risk interference, and parallel computing accelerates analysis. Comprehensive scoring considers both technical hazards and legal consequences, reducing false positives. Compliance adaptation automatically associates legal provisions, providing a direct basis for safe handling.

[0089] In a preferred embodiment, the generation of the treatment strategy in S4 includes:

[0090] Aligning rules / legal clauses: Matching the specific compliance / regulatory clauses violated from the knowledge graph and generating a clause reference chain;

[0091] Generate visual reports: Display attack path maps and corresponding legal basis, supporting attack tracing and compliance auditing.

[0092] After detecting an attack, the system automatically links legal nodes in the knowledge graph to generate a list of violating clauses. Based on attack characteristics (such as unauthorized operation and data leakage), it matches specific clauses in the Cybersecurity Law and the Data Security Law. The system generates an interactive attack path map for intuitive presentation, which can be exported as a PDF / Word document. This map includes the attack timeline, relevant legal text, and recommended actions. These actions include immediate revocation of anomalous account permissions and fines.

[0093] In a preferred embodiment, resource constraint control for adversarial sample generation is also included:

[0094] Monitor GPU memory usage and reduce semantic layer mutation intensity when it exceeds the threshold;

[0095] The NSGA-II algorithm is used to dynamically optimize the mutation parameters, and the objective function is:

[0096] min(E[ΔD]+λ·LegalRisk+μ·ResourceCost)

[0097] Among them, E[ΔD] is the expected detection difference, which is the average success rate of adversarial samples bypassing the target detection model, 0≤E[ΔD]≤1 (the smaller the value, the more subtle the attack); λ is the legal risk weight, which adjusts the importance of legal compliance, λ∈[0,5] (the larger the value, the stricter the legal constraints); LegalRisk is the legal risk value, which is a quantitative assessment of the adversarial sample’s violation of legal provisions, 0≤LegalRisk≤1 (1 indicates serious violation); μ is the resource cost weight, which adjusts the importance of computing resource consumption, μ∈[0,3] (the larger the value, the higher the priority of resource efficiency); ResourceCost is the resource cost, which is the comprehensive cost of GPU memory usage and computing time, 0≤ResourceCost≤1 (1 indicates resource exhaustion).

[0098] This embodiment monitors GPU resource consumption in real time and dynamically adjusts the intensity of adversarial sample generation. Threshold control: When GPU memory usage exceeds 80% (e.g., when generating complex variant samples), the complexity of semantic variation is automatically reduced (e.g., reducing the vocabulary size of text replacement). Elastic recovery: After resources are released (e.g., GPU memory usage drops below 50%), high-intensity variation is gradually restored.

[0099] Multi-objective optimization decision-making, using an intelligent optimization algorithm (NSGA-II), balances three core factors. Attack effectiveness: ensuring adversarial samples can evade AI detection (e.g., disguising ransomware code as legitimate documents). Legal compliance: avoiding generating samples that violate relevant regulations (e.g., not forging government document templates). Resource efficiency: controlling GPU power consumption and time costs (generating a single sample takes no more than 2 seconds).

[0100] In a preferred embodiment, the construction of the legal / compliance label includes:

[0101] Extract key clauses from regulations such as GDPR and CCPA to construct a 12-dimensional compliance vector;

[0102] The GAT model is used to calculate the correlation between instruction features and clause nodes, and clauses with correlation > 0.7 are used as supervisory signals.

[0103] Compliance vector construction (structuring legal knowledge) extracts core clauses from regulations such as GDPR and CCPA to construct a 12-dimensional vector, with each dimension corresponding to a key compliance requirement. Complex legal texts are converted into machine-readable structured labels to support automated compliance testing. Intelligent association matching (precise mapping of clauses) uses a graph attention network (GAT) to analyze the relationship between instruction features and legal clauses. Correlation calculation: The model automatically determines the probability (0-1) that an instruction violates each clause. Supervisory signal generation: Only high-risk clauses with a correlation greater than 0.7 are retained as training labels to ensure strong relevance to the legal basis.

[0104] In a preferred embodiment, the online updating method of the model includes:

[0105] When the number of new nodes in the knowledge graph exceeds the capacity threshold, incremental model fine-tuning is initiated;

[0106] Adopt an elastic weight solidification strategy, keep compliance / legal-related parameters unchanged, and only update the attack pattern detection layer parameters.

[0107] This embodiment monitors the scale of the knowledge graph in real time, and automatically triggers a model update when the number of new nodes exceeds the capacity threshold (such as more than 500 new attack technique and tactics nodes added in a single day). If a large number of artificial intelligence phishing email generator nodes are found to have been added to the dark web recently, the system will determine that the model needs to be updated to adapt to such attacks. Elastic weight solidification technology is used to ensure stable legal compliance capabilities. Legal parameter freezing: Model parameters associated with legal provisions such as GDPR and CCPA are completely locked. Dynamic adjustment of the attack layer: Only the parameters of the attack pattern recognition layer are updated to quickly learn new attack features.

[0108] A malicious command detection system that integrates self-supervised learning and dynamic knowledge graphs, including:

[0109] The data adversarial module is used to generate a legal / compliant adversarial sample library, including a hierarchical mutation unit and a compliance correction unit;

[0110] A multimodal detection module, including a dual-channel encoder that combines legal position encoding and spatiotemporal convolution, and a dynamic knowledge graph engine that correlates attack patterns with legal provisions in real time;

[0111] The self-supervised training module uses contrastive loss and legal / rule loss to jointly optimize model parameters, where positive samples meet the dual thresholds of semantic similarity and attack difference;

[0112] Dynamic decision-making module, used to calculate instruction risk scores, generate disposal strategies containing legal / regulatory basis, and update knowledge graph nodes.

[0113] This system uses four modules to collaboratively implement malicious instruction detection driven by both technical and regulatory compliance. The data adversarial module includes a hierarchical mutation unit, which performs multi-level semantic perturbations on input instructions (such as replacing sensitive words and restructuring grammatical structures) to generate a sample library with diverse attack characteristics. The compliance correction unit automatically filters out variant samples that violate regulations such as GDPR (such as removing adversarial instructions involving racial discrimination), ensuring the compliance and legality of training data. The multimodal detection module includes a dual-channel encoder. The legal encoding channel embeds the location information of legal clauses. The spatiotemporal convolution channel captures the temporal characteristics of attack patterns in instruction sequences (such as abnormal data access after privilege escalation). The dynamic knowledge graph engine matches attack characteristics with legal nodes in real time. Positive samples in the self-supervised training module meet a semantic similarity threshold above and an attack feature similarity threshold below. A contrastive loss forces the model to penetrate the surface of the attack, while a legal loss enhances the accuracy of clause association. The dynamic decision module combines a technical risk score (such as the difficulty of exploiting the vulnerability) with a legal violation score (such as the number of clauses violated) to output a risk score. The disposal strategy automatically generates blocking recommendations for high-risk instructions, citing the original legal text. Graph update: New attack features automatically create knowledge nodes and associate them with relevant legal or regulatory clauses.

[0114] In a preferred embodiment, the data confrontation module further includes:

[0115] The resource monitoring submodule collects GPU memory and CPU utilization in real time and dynamically adjusts mutation parameters;

[0116] The legal revision submodule or the rule revision submodule connects to the knowledge graph database and automatically replaces high-risk keywords in instructions with compliant statements.

[0117] The resource monitoring submodule of this embodiment monitors the hardware resource usage status in real time and dynamically optimizes the efficiency of adversarial sample generation. Video memory regulation: When the GPU video memory usage exceeds a threshold (such as 75%) (such as when generating complex variant samples), the mutation intensity is automatically reduced (such as reducing the vocabulary of text replacement) to prevent the system from freezing. CPU balancing, if the CPU utilization rate is continuously higher than 90%, low-priority tasks (such as historical sample archiving) are automatically queued to prioritize real-time attack detection. The legal revision submodule (compliance enforcement) automatically purifies illegal or non-compliant content of adversarial samples based on the compliance vocabulary of the knowledge graph. High-risk word replacement: Illegal keywords (such as "root permissions" and "delete logs") are detected in the instructions and automatically replaced with compliant expressions (such as "administrator permissions" and "archive logs"). Legal basis association: The corresponding legal terms are recorded for each replacement operation to ensure traceability.

[0118] In a preferred embodiment, the dynamic knowledge graph engine uses a distributed Neo4j cluster, including:

[0119] A time-space relationship storage unit records the first appearance time and geographical distribution of attack techniques and tactics;

[0120] The legal association calculation unit uses the GAT model to calculate the association strength between nodes and legal clauses and weights them according to judicial precedents.

[0121] The dynamic knowledge graph engine utilizes a spatiotemporal relationship storage unit (full-dimensional tracking of attack behavior) based on a distributed Neo4j cluster to record the spatiotemporal characteristics of attack techniques and tactics, enabling rapid tracing and threat prediction. The temporal dimension precisely records the first appearance of attack methods and analyzes the active attack cycle. The geographic dimension identifies the geographical distribution of attack source IP addresses to assist in locating attack groups. The legal relevance calculation unit (precise clause mapping) quantifies the strength of the correlation between attack behavior and legal clauses using a graph attention network (GAT) and incorporates judicial precedents to enhance authority. If a clause is cited repeatedly in Supreme Court precedents, its relevance weight is automatically increased by 10%-30%. The unit calculates the degree of match between attack nodes (e.g., "data tampering") and legal clause nodes, outputting a relevance score between 0 and 1.

[0122] In a preferred embodiment, the dynamic decision-making module includes: a multi-hop reasoning unit, which uses a parallel thread pool to process attack paths within 3 hops and implements a path pruning strategy; a visual report generation unit, which maps attack paths and legal clauses into an interactive graph to support traceability auditing. The multi-hop reasoning unit uses multi-threading to simultaneously process 3 layers of attack paths (such as intrusion, privilege escalation, and data theft), greatly improving the analysis speed. Path pruning: When the cumulative risk value of a single path is less than 0.1 (such as a normal log query), the analysis is automatically terminated, and resources are concentrated on tracking high-risk paths (such as ransomware attack chains). When a high-risk path is detected (such as data theft, cross-border transmission), a blocking instruction is generated within 10 seconds and associated with legal clauses. The visual report generation unit provides one-click compliance evidence, dynamically associating attack steps with legal clauses to form an interactive graph.

[0123] In one embodiment, the system also includes an elastic update module that monitors the frequency of knowledge graph updates and triggers incremental model fine-tuning when the number of newly added nodes exceeds a threshold. It also uses parameter masking technology to freeze parameters in the legal-related layer and only update the fully connected weights in the attack detection layer. The system keeps real-time statistics on the frequency of knowledge graph changes and automatically initiates incremental model learning when the number of newly added attack technique and tactic nodes exceeds a threshold. Parameter masking technology is used to lock the model in a targeted manner, completely fixing parameters associated with provisions such as GDPR and CCPA to ensure zero loss of compliance capabilities. Only the weights in the attack signature recognition layer are adjusted to quickly adapt to variant attacks.

[0124] The present invention constructs a closed-loop malicious instruction detection system from data generation, feature learning to intelligent decision-making. The data adversarial module generates training samples with both attack diversity and legal compliance, which are input into the dual-channel encoder for multimodal analysis of instruction semantics and context features, and is simultaneously combined with the dynamic knowledge graph to perform association mapping between attack patterns and legal clauses; the self-supervised training module forces the model to penetrate the attack appearance and strengthen the cognition of legal boundaries through the joint optimization of contrast loss and legal loss; the dynamic decision-making module is based on the multi-hop reasoning ability of the knowledge graph, integrates technical risks and legal risks to generate disposal strategies, and realizes the continuous evolution of the system through node weight adjustment and incremental learning. Each module forms an organic synergy through the spatiotemporal relationship storage and legal association calculation of the knowledge graph, and ultimately achieves a dual improvement in the accuracy of malicious instruction detection and legal compliance.

[0125] Although preferred embodiments of the present invention have been described, once those skilled in the art understand the basic innovative concepts, they may make other changes and modifications to these embodiments. Therefore, the appended claims are intended to cover the preferred embodiments and all changes and modifications that fall within the scope of the present invention. The above content is only an illustration of the preferred embodiments of the present invention and is not intended to limit the present invention. It should be emphasized that any modifications, equivalent substitutions, and improvements made under the guidance of the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A malicious instruction detection method integrating self-supervised learning and dynamic knowledge graph, characterized in that: Includes the following: S1: Obtain user instruction data and corresponding compliance labels, construct an adversarial sample generation matrix, and generate an adversarial sample library through layered mutation and compliance correction; S2: Input the original instruction and the adversarial sample into a multimodal detection model, which includes a dual-channel encoder and a dynamic knowledge graph module; S3: Optimize the model through a self-supervised contrastive loss function, where positive samples must satisfy the semantic similarity above a threshold and the attack feature similarity below a threshold, and negative samples are instructions that violate predefined rules. S4: Input the instructions to be detected into the trained model, extract the instruction features and perform multi-hop reasoning with the knowledge graph to calculate the risk score; when malicious instructions are detected, generate a disposal strategy including blocking actions and legal basis, and dynamically update the knowledge graph nodes.

2. The malicious instruction detection method integrating self-supervised learning and dynamic knowledge graph according to claim 1 is characterized in that: The construction of the adversarial sample generation matrix described in S1 specifically includes: Define the mutation parameter space, including lexical perturbation intensity, risk threshold, and resource consumption constraints; Adopting a hierarchical mutation strategy, it sequentially performs Unicode character replacement, syntax tree reorganization, and semantic equivalence conversion; Generate samples based on real-time corrections to the knowledge graph, replacing high-risk keywords with compliant expressions.

3. The malicious instruction detection method integrating self-supervised learning and dynamic knowledge graph according to claim 1 is characterized in that: The dual-channel encoder in S2 includes: Instruction encoding channel: injecting compliant positional encoding into the RoBERTa model; Context encoding channel: It adopts a structure combining dilated convolution and BiLSTM, and introduces a time decay factor to enhance the recency effect.

4. The malicious instruction detection method integrating self-supervised learning and dynamic knowledge graph according to claim 1 is characterized in that: The self-supervised contrast loss function described in S3 is L = γ·L_contrast+(1-γ)·L_legal, where: L_contrast uses InfoNCE loss; L_legal is a multi-label cross entropy loss that calculates the probability of violation of instructions and rules.

5. The method for detecting malicious instructions by integrating self-supervised learning and dynamic knowledge graph according to claim 1 is characterized in that: The updates of the dynamic knowledge graph described in S4 include: Collect threat intelligence and compliance clauses in real time, and build a graph that includes attack technique and tactic nodes, rule clause nodes, and temporal and spatial relationships; When a new attack is detected, a correlation subgraph is created and the risk propagation value is calculated; If the subgraph risk value exceeds the threshold, the graph node weight is dynamically adjusted.

6. The method for detecting malicious instructions by integrating self-supervised learning and dynamic knowledge graph according to claim 5 is characterized in that: The multi-hop reasoning of the knowledge graph specifically includes: Path pruning: terminate the search when the cumulative risk value is <0.1; Parallel computing: Use thread pool to simultaneously process all attack paths within 3 hops.

7. The method for detecting malicious instructions by integrating self-supervised learning and dynamic knowledge graph according to claim 1 is characterized in that: The generation of the disposal strategy in S4 includes: Align clauses: Match specific compliance items that have been violated from the knowledge graph and generate clause reference chains; Generate visual reports: Display attack path maps and corresponding legal basis, supporting attack tracing and compliance auditing.

8. The method for detecting malicious instructions by integrating self-supervised learning and dynamic knowledge graph according to claim 1 is characterized in that: Online model update methods include: When the number of new nodes in the knowledge graph exceeds the capacity threshold, incremental model fine-tuning is initiated; An elastic weight solidification strategy is adopted to keep the relevant parameters unchanged and only update the attack mode detection layer parameters.

9. A malicious instruction detection system integrating self-supervised learning and dynamic knowledge graph, characterized in that: include: The data adversarial module is used to generate a library of compliant adversarial samples, including a hierarchical mutation unit and a compliant correction unit; Multimodal detection module, including a dual-channel encoder and a dynamic knowledge graph engine; The self-supervised training module uses contrastive loss and loss to jointly optimize model parameters, where positive samples meet the dual thresholds of semantic similarity and attack difference; The dynamic decision module is used to calculate the instruction risk score, generate a disposal strategy containing the basis, and update the knowledge graph node.

10. The malicious instruction detection system integrating self-supervised learning and dynamic knowledge graph according to claim 9 is characterized in that: The dynamic decision-making module includes: a multi-hop reasoning unit that uses a parallel thread pool to process attack paths within 3 hops and implements a path pruning strategy; a visual report generation unit that maps attack paths and legal terms into an interactive graph to support traceability auditing.

Images