Network security and data security comprehensive analysis method and system based on large model

Abstract

The invention provides a network security and data security comprehensive analysis method and system based on a large model, and the method comprises the steps: collecting multi-source heterogeneous security data of a network communication link, a data storage node and an application interaction interface, carrying out the risk behavior atomization association processing, and constructing a dynamic risk association hypergraph; based on a preset security domain knowledge graph, calling the large model to execute multiple rounds of risk attribution reasoning, performing attack chain fragment matching and evidence chain completion on a behavior hyperedge set in the dynamic risk association hypergraph, and generating a risk attribution reasoning chain; and constructing a risk evolution probability model according to the risk attribution reasoning chain and the time sequence constraint set of the dynamic risk association hypergraph, and calculating a short-term diffusion probability and a long-term evolution trend vector of each association risk path based on the risk evolution probability model to obtain a risk evolution path prediction result. The pertinence and the dynamic adaptability of protection measures can be improved, and the problem that a static protection strategy is difficult to deal with the hysteresis quality of dynamic risk changes is solved.

Description

Technical Field

[0001] The present invention relates to the fields of data analysis and machine learning, and in particular to a method and system for comprehensive analysis of network security and data security based on a large model. Background Art

[0002] In the digital age, comprehensive analysis of network security and data security plays an important role in ensuring the stable operation of information systems. Its core goal is to identify potential risks and take targeted protective measures by analyzing various security data in the network environment. At present, common comprehensive analysis methods for network security and data security usually collect security data such as network traffic and system logs, analyze the data through rule matching or simple models, identify abnormal behaviors and assess risk levels. However, when processing multi-source heterogeneous security data, existing technologies have difficulty in effectively associating the potential risk relationships between data from different sources, resulting in an incomplete characterization of the collaborative risk behaviors of multiple entity nodes; in the risk attribution process, due to the fragmentation of the attack chain or the emergence of new attack modes, it is often impossible to accurately trace the main risk nodes and the complete associated risk paths, and the generated protection strategies lack specificity and dynamic adaptability. Summary of the Invention

[0003] The present invention provides a large-scale model-based comprehensive analysis method and system for network security and data security.

[0004] In the first aspect, an embodiment of the present invention provides a comprehensive analysis method for network security and data security based on a large model, including: collecting multi-source heterogeneous security data from network communication links, data storage nodes and application interaction interfaces, the multi-source heterogeneous security data including encrypted transmission data packet units, data access audit units and interface call sequence units, and each data unit carries a node identifier and an interaction timestamp; performing risk behavior atomic association processing on the multi-source heterogeneous security data to construct a dynamic risk association hypergraph; based on a preset security domain knowledge graph, calling a large model to perform multiple rounds of risk attribution reasoning, performing attack chain fragment matching and evidence chain completion on the behavior hyperedge set in the dynamic risk association hypergraph, and generating a risk attribution reasoning chain including main cause risk nodes, associated risk paths and evidence confidence; constructing a risk evolution probability model based on the risk attribution reasoning chain and the timing constraint set of the dynamic risk association hypergraph, and calculating the short-term diffusion probability and long-term evolution trend vector of each associated risk path based on this, to obtain a risk evolution path prediction result.

[0005] In a second aspect, an embodiment of the present invention provides a computer system, comprising: a memory storing a computer program; and a processor for loading the computer program to implement the large model-based comprehensive analysis method for network security and data security as described above.

[0006] The present invention provides a comprehensive analysis method for network security and data security based on a large model, which collects multi-source heterogeneous security data of network communication links, data storage nodes and application interaction interfaces, ensures that the acquired data contains encrypted transmission data packet units, data access audit units and interface call sequence units and carries node identification and interaction time stamps, and provides a comprehensive and relevant data basis for subsequent security analysis; constructs a dynamic risk association hypergraph by atomically correlating risk behaviors of multi-source heterogeneous security data, utilizes an entity node set including communication nodes, storage nodes and interface nodes, a behavior hyperedge set connecting multiple entity nodes, and a timing constraint set limiting the time relationship of hyperedges, and can accurately capture the correlation and timing dynamics of collaborative risk behaviors among multiple entity nodes, solving the problem that traditional graph structures can only express bilateral node associations but cannot reflect multi-node collaborative risks; executes multiple rounds of risk attribution reasoning based on the security field knowledge graph by calling a large model, and analyzes the behavior hyperedges. The attack chain fragments are matched and the evidence chain is completed by the set to generate a risk attribution reasoning chain including the main risk node, associated risk path and evidence confidence. It can effectively handle scenarios with incomplete attack chains or new attack modes, improve the accuracy of risk attribution, and break through the limitation of simple pattern matching relying on preset rule bases. By constructing a risk evolution probability model based on the risk attribution reasoning chain and the temporal constraint set, the short-term diffusion probability and long-term evolution trend vector of each associated risk path are calculated, and a refined dynamic description of risk evolution is achieved, which solves the problem that traditional single probability prediction cannot reflect the evolution characteristics of risk in the time dimension. By generating a dynamic security protection solution including node protection priority, path blocking strategy and interface access control rules based on the short-term diffusion probability and long-term evolution trend vector, the protection strategy can be matched with the risk evolution status in real time, improving the pertinence and dynamic adaptability of the protection measures, and solving the lag problem that static protection strategies are difficult to cope with dynamic changes in risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Figure 1 This is a flowchart of a comprehensive network security and data security analysis method based on a large model provided by an embodiment of the present invention.

[0008] Figure 2 It is a schematic diagram of the composition of a computer system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0009] See also Figure 1 , Figure 1 A flowchart of a method for comprehensive network security and data security analysis based on a large model provided in an embodiment of the present invention. The method can be executed by a computer system and may include the following steps: The large-scale model-based comprehensive analysis method for network security and data security provided in the embodiments of this application can be applied to many fields such as e-commerce, finance, healthcare, industrial control, and government affairs. In order to more clearly and specifically illustrate the implementation process and advantages of this method, the following detailed description is given using the e-commerce scenario as an example. However, this method is not limited to the e-commerce scenario and can also play an important role in other fields mentioned or not mentioned, effectively responding to security challenges in various complex network environments and achieving comprehensive analysis and protection of network security and data security.

[0010] Step S100: Collect multi-source heterogeneous security data of network communication links, data storage nodes and application interaction interfaces. The multi-source heterogeneous security data includes encrypted transmission data packet units, data access audit units and interface call sequence units. Each data unit carries a node identifier and an interaction timestamp.

[0011] Multi-source, heterogeneous security data originates from various components and systems within the network, varying in type and format. The encrypted transmission data packet unit is a collection of encrypted data packets transmitted within a network communication link. These packets carry essential network communication information, such as source address, destination address, and port number. Encryption is performed to ensure data transmission security. The data access audit unit records the details of data access operations performed on data storage nodes, including the access subject, operation object, operation time, and operation type, for auditing and monitoring data access behavior. The interface call sequence unit records the application interaction interface call process and related information, such as the call sequence, input parameters, and return results, reflecting the interaction between applications. Node identifiers uniquely distinguish individual nodes within the network, such as communication nodes, storage nodes, and interface nodes, facilitating data management across different nodes. The interaction timestamp records the time information of each data unit during network interaction, used to determine the sequence and time interval of data interactions.

[0012] When collecting multi-source, heterogeneous security data, network packet capture tools can be deployed within the network communication link for encrypted data packet transmission. For example, specialized packet capture software can be used. This software monitors network traffic, captures all packets passing through the network interface, and performs preliminary parsing and logging of encrypted packets. For data access auditing, audit software is deployed on data storage nodes to monitor and log all data access operations in real time. Whenever a user or program accesses a data storage node, the audit software records every aspect of the access. For interface call sequencers, logging functionality is added to application interaction interfaces. Whenever an interface is called, relevant information, including the call time, input parameters, and return status, is automatically recorded. For example, within an e-commerce platform, packet capture software can be deployed on the core switch of the network to capture encrypted data packets transmitted between servers. Audit software can be installed on the database server to record user access to the product database. Logging functionality can also be added to the interfaces of e-commerce applications to record user calls to interfaces such as order placement and product query. Each collected data unit will automatically add a node identifier and an interaction timestamp. The node identifier can be generated according to pre-defined rules, such as encoding according to the network area and function of the node, and the interaction timestamp is automatically recorded by the system clock.

[0013] Step S200: Perform risk behavior atomic association processing on multi-source heterogeneous security data to construct a dynamic risk association hypergraph. The dynamic risk association hypergraph includes an entity node set, a behavior hyperedge set, and a temporal constraint set. The entity node set includes communication nodes, storage nodes, and interface nodes.

[0014] Atomized risk behavior correlation processing deconstructs and correlates various risk behaviors within multi-source, heterogeneous security data, breaking down complex risk behaviors into atomic-level features and establishing correlations between these features. For example, these multiple dimensions can encompass the following aspects: From the data source perspective, multi-source, heterogeneous security data originates from network communication links, data storage nodes, and application interaction interfaces—three distinct data source dimensions. Data from network communication links reflects risk behaviors at the network level, data storage nodes reflect risks during data storage and access, and application interaction interface data reveals risks during application interaction. From the behavioral feature perspective, processing multi-source, heterogeneous security data generates different types of atomic behavioral features, such as communication behavior atomic features, access behavior atomic features, and interface behavior atomic features. Communication behavior atomic features focus on network communication characteristics, such as transmission direction identifiers, payload length sequences, and encryption algorithm types; access behavior atomic features focus on data access operations, including access subject identifiers, operation object paths, and permission change records; and interface behavior atomic features focus on interface call details, including interface identifiers, input parameter summaries, and return status codes. From a temporal perspective, each data unit carries an interaction timestamp, enabling the analysis of risky behaviors to consider their sequence and time intervals. By segmenting the timestamp sequence into time intervals, the co-occurrence frequency and temporal dependency of atomic behavioral features within different time intervals can be calculated, thereby establishing temporal correlations between risky behaviors. When constructing a dynamic risk association hypergraph, these multi-dimensional information interacts. The entity node set is constructed based on different data sources and behavioral feature dimensions. The behavioral hyperedge set considers the co-occurrence frequency and temporal dependency of atomic behavioral features between different entity nodes in the temporal dimension. The temporal constraint set further constrains the temporal order of behavioral hyperedges, enabling multi-dimensional atomic correlation of risky behaviors. The dynamic risk association hypergraph is a graph structure used to represent cybersecurity risks, providing a more comprehensive description of risk relationships within the network. The entity node set is the collection of nodes in the hypergraph. Communication nodes represent communication devices or links in the network, storage nodes represent data storage devices or locations, and interface nodes represent application interfaces. A behavioral hyperedge set is a collection of hyperedges connecting multiple entity nodes. These hyperedges embody the complex behavioral relationships between these entities, and each hyperedge has a corresponding weight. A temporal constraint set is used to define the temporal order of occurrence of each hyperedge in the behavioral hyperedge set, ensuring the temporal correctness of risk associations.

[0015] As an implementation manner, step S200 may be specifically implemented as the following steps S210-S270: Step S210: Perform protocol reverse analysis on the encrypted transmission data packet unit in the multi-source heterogeneous security data, extract the transmission direction identifier, payload length sequence and encryption algorithm type, and generate atomic features of communication behavior.

[0016] Protocol reverse engineering involves in-depth analysis and processing of encrypted transmission data packets to recover the protocol information followed by the packets. The transmission direction identifier is used to specify the transmission direction of the packet, i.e., from the source node to the destination node or from the destination node to the source node. The payload length sequence is a sequence of the payload length information in the packet, arranged in the order of the packets. The encryption algorithm type refers to the encryption algorithm used by the packet, such as common symmetric or asymmetric encryption algorithms. Communication behavior atomic features are a set of basic features used to describe network communication behavior. They are generated by extracting information such as the transmission direction identifier, payload length sequence, and encryption algorithm type.

[0017] When performing protocol reverse engineering, a professional protocol analysis tool can be used. This tool first identifies the packet header and uses fields within the header to determine the transmission direction. For example, the header may contain fields specifically indicating the source and destination addresses, and the relationship between these addresses can be used to determine the transmission direction. The tool then extracts the payload from the packet, calculates its length, and records it sequentially to form a payload length sequence. To determine the encryption algorithm type, the tool analyzes the encryption algorithm-related fields within the packet, which may contain algorithm identification information. The encryption algorithm type is determined by comparing it against a predefined library of algorithm identifiers. On e-commerce platforms, when product data is transmitted between servers, protocol analysis tools are used to parse these encrypted packets. The tool extracts the transmission direction (e.g., from a product inventory server to an order processing server), the payload length sequence (e.g., a sequence of bytes of a certain length), and the encryption algorithm type (e.g., a symmetric encryption algorithm), thereby generating atomic signatures of the communication behavior.

[0018] Step S220: Decompose the operation sequence of the data access audit unit in the multi-source heterogeneous security data, extract the access subject identifier, operation object path and permission change record, and generate the access behavior atomic feature.

[0019] Operation sequence decomposition is to split and analyze a series of data access operations recorded in the data access audit unit, breaking down complex operation processes into individual operation steps. The access subject identifier is used to uniquely identify the subject performing the data access operation, which can be a user account, application, etc. The operation object path refers to the specific location path of the accessed data object in the data storage system, which is used to accurately locate the data. The permission change record refers to a detailed record of changes in the permissions of the access subject during the data access process, such as the increase or decrease of permissions. The access behavior atomic features are a set of basic features used to describe data access behavior, which are generated by extracting information such as the access subject identifier, operation object path, and permission change record.

[0020] When decomposing operation sequences, a log analysis tool is used. This tool analyzes the log information in the data access audit unit line by line. First, it extracts the access subject identifier for each operation step from the log, using a specified field or identifier. Next, it determines the operation object path based on relevant information in the operation record. For example, the record may contain information such as the data storage directory and file name. Combining this information yields the operation object path. Finally, the log is checked for permission change records. Using a specified identifier or flag, it determines whether permissions have changed and extracts relevant information. On an e-commerce platform, when a user accesses a product database, the log analysis tool analyzes the database access audit log. It extracts the access subject identifier (such as the user's account name), the operation object path (such as the specific path to a table in the product database), and the permission change record (such as a user changing from read-only to read-write permissions), thereby generating atomic features of the access behavior.

[0021] Step S230: perform call chain tracing on the interface call sequence units in the multi-source heterogeneous security data, extract the interface identifier, input parameter summary and return status code, and generate interface behavior atomic features.

[0022] Call chain tracing is the process of tracking and analyzing the interface call process in the interface call sequence unit to determine the order and path of the interface calls. The interface identifier is used to uniquely identify an interface, usually the name or number of the interface. The input parameter summary simplifies and summarizes the parameters input when the interface is called, which is used to quickly understand the input status of the interface call. The return status code is the result status information returned after the interface call is completed, which is used to indicate whether the interface call is successful or an error occurs. Interface behavior atomic features are a set of basic features used to describe interface call behavior. They are generated by extracting information such as the interface identifier, input parameter summary, and return status code.

[0023] When tracing call chains, a distributed tracing tool is used. This tool inserts tracing code at each stage of an interface call. When the interface is called, the tracing code records the call's information. First, the tracing code determines the interface identifier, which may be clearly identified in the interface's definition or configuration file. Then, the input parameters of the interface call are extracted, analyzed, and processed, extracting key parameter information to form an input parameter summary. Finally, the return status code of the interface call is obtained. The return status code is typically a set field in the interface's response. On e-commerce platforms, when a user queries product information through an interface, the distributed tracing tool tracks the interface call process. By extracting the interface identifier (such as the interface name for the product information query), the input parameter summary (such as key parameters such as the product category being queried), and the return status code (such as the status code indicating a successful query), atomic features of the interface behavior are generated.

[0024] Step S240: Map the communication behavior atomic features, access behavior atomic features and interface behavior atomic features into a set of entity nodes of a dynamic risk association hypergraph, wherein the communication behavior atomic features are mapped into communication nodes, the access behavior atomic features are mapped into storage nodes, and the interface behavior atomic features are mapped into interface nodes.

[0025] In an embodiment of the present application, the communication behavior atomic features, access behavior atomic features and interface behavior atomic features are respectively mapped to the communication nodes, storage nodes and interface nodes in the entity node set of the dynamic risk association hypergraph. The purpose of this is to represent different types of behavior features in the form of nodes in the hypergraph, which is convenient for risk association analysis. When mapping, the correspondence is made according to the type and meaning of the feature. For the communication behavior atomic features, the information contained therein is mapped to the communication node. For example, the attributes of the communication node can be set to the transmission direction identifier, payload length sequence and encryption algorithm type in the communication behavior atomic features. For the access behavior atomic features, the corresponding information is mapped to the storage node, and the attributes of the storage node may include the access subject identifier, operation object path and permission change record, etc. For the interface behavior atomic features, the corresponding information is mapped to the interface node, and the attributes of the interface node may include the interface identifier, input parameter summary and return status code, etc. In the e-commerce platform, the previously generated atomic features of communication behavior (such as the transmission direction from the product inventory server to the order processing server, a payload length sequence of a certain length, and a certain type of symmetric encryption algorithm) are mapped to a communication node; the atomic features of access behavior (such as the user account's access to a table in the product database, the change of permissions from read-only to read-write) are mapped to a storage node; and the atomic features of interface behavior (such as the product information query interface, the input product category parameters, and the return status code of a successful query) are mapped to an interface node.

[0026] Step S250: Calculate the co-occurrence frequency and temporal dependency of the behavior atomic features between different entity nodes based on the interaction timestamps, and construct a behavior hyperedge set connecting multiple entity nodes.

[0027] Co-occurrence frequency refers to the frequency with which behavioral atomic features between different entity nodes appear simultaneously within the same time interval. Temporal dependency refers to the temporal dependency between behavioral atomic features between different entity nodes. This is measured by calculating the conditional probability of the preceding and subsequent behavioral atomic features. A behavioral hyperedge set is a collection of hyperedges connecting multiple entity nodes. Hyperedges represent complex behavioral relationships between these nodes, and each hyperedge has a corresponding weight that indicates the importance of that relationship.

[0028] As an implementation manner, step S250 may be specifically implemented as the following steps S251-S256: Step S251: extracting the interaction time stamp sequence of the communication node, storage node and interface node, and determining the occurrence time point of the atomic feature of each node behavior.

[0029] The interaction timestamp sequence refers to the sequence of interaction timestamps corresponding to the behavior atomic features of communication nodes, storage nodes, and interface nodes. The occurrence time point refers to the specific moment on the timeline when the behavior atomic feature of each node occurs.

[0030] When extracting interaction timestamp sequences, the interaction timestamps corresponding to each node's behavior atomic features are extracted from previously collected multi-source heterogeneous security data based on the association between node identifiers and behavior atomic features. These are then arranged chronologically to form a sequence. For example, on an e-commerce platform, the interaction timestamps corresponding to the communication behavior atomic features of communication nodes (such as data transmission between servers) are sequentially timed at different points in time. The interaction timestamps corresponding to the access behavior atomic features of storage nodes (such as accessing a product database) are also sequentially timed at different points in time. Similarly, the interaction timestamps corresponding to the interface behavior atomic features of interface nodes (such as invoking a user interface) are sequentially timed at different points in time. By extracting these interaction timestamps, the time at which the behavior atomic features of each node occurred is determined.

[0031] Step S252: segment the timestamp sequence by time interval division, count the number of combinations of communication node behavior atomic features, storage node behavior atomic features, and interface node behavior atomic features that appear simultaneously in each time interval, and obtain the co-occurrence frequency.

[0032] The time interval partitioning method divides the time axis into several equal or unequal time intervals. The co-occurrence frequency refers to the frequency with which the behavioral atomic features of different types of nodes appear simultaneously in the same time interval.

[0033] When dividing time intervals, choose an appropriate time interval length based on actual circumstances. The timeline can be divided into fixed-length intervals or unequal intervals based on the specifics of the business. Then, analyze the timestamp sequence within each interval and count the number of simultaneous combinations of atomic features of communication node behavior, atomic features of storage node behavior, and atomic features of interface node behavior. On an e-commerce platform, for example, divide a day into several hourly intervals. Within each hourly interval, count the number of simultaneous combinations of inter-server communication, product database access, and user interface call behavior. The greater the number of combinations, the higher the co-occurrence frequency.

[0034] Step S253: Mark the behavior atomic feature combinations within each time interval in time sequence, and calculate the conditional probability of the preceding behavior atomic feature and the subsequent behavior atomic feature as the time sequence dependency.

[0035] Temporal sequence labeling involves marking the atomic feature combinations of behaviors within each time interval in the order of their occurrence, clarifying which behaviors are predecessors and which are successors. Conditional probability refers to the probability of a successor behavior occurring given that the predecessor behavior has occurred. Temporal dependency is expressed by calculating the conditional probability of the atomic features of the predecessor and successor behaviors.

[0036] When performing temporal sequence marking, the order of behavioral atomic features is determined based on the interaction timestamps. For each combination of behavioral atomic features within a time interval, the behavior that occurs first is marked as the predecessor behavior, and the behavior that occurs later is marked as the successor behavior. Next, the number of simultaneous occurrences of the predecessor and successor behaviors, as well as the total number of occurrences of the predecessor behavior, are counted. The number of simultaneous occurrences of the predecessor and successor behaviors is divided by the total number of occurrences of the predecessor behavior to obtain the conditional probability, which is the temporal dependency. On an e-commerce platform, within a certain time interval, a user first calls the product query interface (predecessor behavior) and then makes a product purchase (subsequent behavior). The number of times a user makes a product purchase after a product query, as well as the total number of product queries, is counted. The conditional probability of a product purchase after a product query is calculated as the temporal dependency between these two behavioral atomic features.

[0037] Step S254: converting the co-occurrence frequency into a co-occurrence weight of a preset numerical interval by using a maximum value normalization method, and converting the temporal dependency into a dependency weight of a preset numerical interval by using a maximum value normalization method.

[0038] Maximum normalization compares and transforms raw data with the maximum value, mapping the data to a preset numerical range. Co-occurrence weights are weights derived by normalizing the co-occurrence frequencies and are used to indicate the importance of the co-occurrence of behavioral atomic features between different entity nodes. Dependency weights are weights derived by normalizing the temporal dependencies and are used to indicate the importance of the temporal dependencies between behavioral atomic features between different entity nodes. The preset numerical range is typically a fixed range, such as from zero to one.

[0039] When performing maximum normalization, first find the maximum values ​​of the co-occurrence frequency and temporal dependency. For co-occurrence frequency, divide each co-occurrence frequency value by the maximum co-occurrence frequency value to obtain the normalized co-occurrence weight. For temporal dependency, divide each temporal dependency value by the maximum temporal dependency value to obtain the normalized dependency weight. On e-commerce platforms, calculate the co-occurrence frequency and temporal dependency of the behavioral atomic features between different entity nodes, and then find the maximum value among these values. Perform maximum normalization on each co-occurrence frequency value and temporal dependency value to obtain the corresponding co-occurrence weight and dependency weight.

[0040] Step S255: performing weighted summation on the co-occurrence weight and the dependency weight according to a preset ratio to obtain the comprehensive weight of the behavior hyperedge.

[0041] The preset ratio is the proportion of the co-occurrence weight and the dependency weight in the weighted sum. The combined weight is the weighted sum of the co-occurrence weight and the dependency weight according to the preset ratio, which is used to indicate the importance of the behavior hyperedge.

[0042] When performing the weighted summation, the co-occurrence weight and the dependency weight are multiplied by the corresponding scaling factor according to a preset ratio. The two results are then added together to obtain the overall weight of the behavioral hyperedge. In e-commerce platforms, it is assumed that the preset ratio is that the co-occurrence weight accounts for a certain proportion and the dependency weight accounts for another. The previously obtained co-occurrence weight and dependency weight are weighted and summed according to this ratio to obtain the overall weight of the behavioral hyperedge.

[0043] Step S256: Based on the type and number of entity nodes in the behavior atomic feature combination, a hyperedge structure including two or more entity nodes is constructed, and a comprehensive weight is assigned to the hyperedge structure to generate a behavior hyperedge set.

[0044] A hyperedge is a graph structure used to represent complex relationships between multiple entity nodes. Unlike ordinary edges, a hyperedge can connect more than two entity nodes. A behavioral hyperedge set is a collection of multiple hyperedge structures, each with a corresponding weight.

[0045] When constructing a hyperedge structure, the hyperedge connection method is determined based on the type (e.g., communication nodes, storage nodes, interface nodes) and number of entity nodes involved in the behavior atomic feature combination. If the behavior atomic feature combination involves multiple entity nodes of different types, a hyperedge structure connecting these nodes is constructed. Then, the previously calculated comprehensive weight is assigned to this hyperedge structure. This process is repeated to generate a behavior hyperedge set containing multiple hyperedge structures. In an e-commerce platform, when a behavior atomic feature combination involves communication nodes between servers, storage nodes for the product database, and interface nodes for the user interface, a hyperedge structure connecting these three nodes is constructed, and the calculated comprehensive weight is assigned to this hyperedge structure. By processing multiple such behavior atomic feature combinations, a behavior hyperedge set is generated.

[0046] Step S260: Generate a timing constraint set based on the interactive time stamps of the multi-source heterogeneous security data. The timing constraint set is used to limit the occurrence time sequence of each hyperedge in the behavior hyperedge set.

[0047] A temporal constraint set is a set of constraints that define the temporal order of occurrence of hyperedges within a behavior hyperedge set. Generating a temporal constraint set ensures that the temporal relationships between hyperedges in subsequent risk analysis are consistent with actual conditions, improving analysis accuracy.

[0048] As an implementation manner, step S260 may be specifically implemented as the following steps S261-S264: Step S261: extract the occurrence timestamps of all behavior hyperedges in the dynamic risk association hypergraph, establish a hyperedge timestamp sequence, and sort the hyperedge timestamp sequence in ascending order to determine the time sequence of each behavior hyperedge.

[0049] The hyperedge timestamp sequence is formed by sequentially arranging the occurrence timestamps of all behavior hyperedges in the dynamic risk association hypergraph. Ascending sorting arranges the timestamp sequence from smallest to largest. By ascending sorting the hyperedge timestamp sequence, the temporal order of each behavior hyperedge can be clearly determined, providing a foundation for subsequently generating temporal constraints.

[0050] When extracting the occurrence timestamps of behavioral hyperedges, we obtain them from the information recorded during the previous construction of the dynamic risk association hypergraph. Each behavioral hyperedge corresponds to a related behavioral atomic feature, which is in turn associated with the interaction timestamp. Therefore, the occurrence timestamps of behavioral hyperedges can be extracted through this association. These timestamps are arranged in sequence to form a hyperedge timestamp sequence, and then a sorting algorithm, such as the quick sort algorithm, is used to sort this sequence in ascending order. On the e-commerce platform, the occurrence timestamps of all communication hyperedges between servers and user interface call hyperedges are extracted. A hyperedge timestamp sequence is established and sorted in ascending order to determine the chronological order of each behavioral hyperedge.

[0051] Step S262: For any two behavior hyperedges that share a shared entity node, if the occurrence timestamp of the preceding behavior hyperedge is earlier than the occurrence timestamp of the succeeding behavior hyperedge, a time precedence constraint relationship is generated.

[0052] A temporal precedence constraint is a constraint that states that the occurrence time of the preceding hyperedge must be earlier than the occurrence time of the subsequent hyperedge between two behavior hyperedges that share a shared entity node. A shared entity node means that the entity nodes connected by two behavior hyperedges contain the same node.

[0053] When generating a temporal precedence constraint, traverse the behavioral hyperedge set and find any two behavioral hyperedges that have a shared entity node. Then, compare their occurrence timestamps. If the occurrence timestamp of the preceding behavioral hyperedge is earlier than the occurrence timestamp of the succeeding behavioral hyperedge, a temporal precedence constraint is generated. In the e-commerce platform, behavioral hyperedge A connects the server node and the user interface node, and behavioral hyperedge B also connects the server node and another user interface node, which is a shared entity node. If the occurrence timestamp of behavioral hyperedge A is earlier than the occurrence timestamp of behavioral hyperedge B, a temporal precedence constraint is generated, indicating that behavioral hyperedge A must occur before behavioral hyperedge B.

[0054] Step S263: For the behavior hyperedges containing the same entity node set, the time interval between their occurrence timestamps is calculated. If the time interval is less than a preset minimum interval threshold, a time overlap constraint relationship is generated.

[0055] The time interval is the difference between the timestamps of two behavior hyperedges. The preset minimum interval threshold is a pre-set time value used to determine whether the occurrence times of two behavior hyperedges are too close. A temporal overlap constraint specifies that the occurrence times of two behavior hyperedges containing the same set of entity nodes overlap.

[0056] When calculating the time interval, for behavioral hyperedges containing the same set of entity nodes, the occurrence timestamp of the previous hyperedge is directly subtracted from the occurrence timestamp of the latter hyperedge. If the time interval is less than the preset minimum interval threshold, a time overlap constraint relationship is generated. In the e-commerce platform, behavioral hyperedge C and behavioral hyperedge D both connect to the same server node and user interface node, and the time interval between their occurrence timestamps is calculated. If the time interval is less than the preset minimum interval threshold, a time overlap constraint relationship is generated, indicating that the occurrence times of behavioral hyperedge C and behavioral hyperedge D overlap.

[0057] Step S264: structurally encode all generated time sequence constraint relationships and time overlap constraint relationships to generate a temporal constraint set including hyperedge identification pairs and constraint types.

[0058] Structured encoding encodes temporal precedence and temporal overlap constraints in a structured manner for easy storage and processing. A hyperedge identifier pair uniquely identifies two hyperedges. The constraint type can be either a temporal precedence constraint or a temporal overlap constraint.

[0059] During structured coding, each temporal precedence constraint and temporal overlap constraint is represented as a structure containing a hyperedge identifier pair and a constraint type. For example, a temporal precedence constraint is represented as a structure containing a preceding hyperedge identifier, a succeeding hyperedge identifier, and a temporal precedence constraint type. A temporal overlap constraint is represented as a structure containing two hyperedge identifiers and a temporal overlap constraint type. All such structures are combined to generate a temporal constraint set containing a hyperedge identifier pair and a constraint type. In the e-commerce platform, all generated temporal precedence constraint and temporal overlap constraint relationships are structured coded to generate a temporal constraint set.

[0060] Step S270: Integrate the entity node set, the behavior hyperedge set, and the timing constraint set into a hypergraph structure to generate a dynamic risk association hypergraph including node attributes, hyperedge weights, and timing constraints.

[0061] Hypergraph structure integration combines and associates entity node sets, behavioral hyperedge sets, and temporal constraint sets to form a complete dynamic risk-related hypergraph. Node attributes refer to the various attribute information possessed by entity nodes, such as the transmission direction identifier for communication nodes and the operation object path for storage nodes. Hyperedge weights are the combined weights of each hyperedge in the behavioral hyperedge set, representing the importance of the hyperedge. Temporal constraints refer to the constraints in the temporal constraint set, which define the temporal order of hyperedge occurrence.

[0062] When integrating the hypergraph structure, the entity node set is first treated as the hypergraph's nodes, the behavioral hyperedge set as the hyperedges, and hyperedge weights are assigned to the corresponding hyperedges. Then, the timing constraint set is associated with the hyperedge set to ensure that the temporal relationships of the hyperedges meet the constraints. For each hyperedge, it is checked whether it satisfies the temporal precedence and temporal overlap constraints in the timing constraint set. Finally, a complete dynamic risk association hypergraph is generated, including node attributes, hyperedge weights, and timing constraints. In the e-commerce platform, communication nodes, storage nodes, and interface nodes are treated as the entity node set, and the behavioral hyperedges connecting these nodes are treated as the behavioral hyperedge set. The previously calculated hyperedge comprehensive weights are assigned to the corresponding hyperedges. Simultaneously, the generated timing constraint set is associated with the hyperedge set to generate a dynamic risk association hypergraph.

[0063] Step S300: Based on the preset security domain knowledge graph, call the large model to perform multiple rounds of risk attribution reasoning, perform attack chain fragment matching and evidence chain completion on the behavior hyperedge set in the dynamic risk association hypergraph, and generate a risk attribution reasoning chain including the main cause risk node, associated risk path and evidence confidence.

[0064] The pre-defined security domain knowledge graph contains a wide range of cybersecurity knowledge and information, such as common attack patterns, vulnerability characteristics, and defense rules. A large model is an AI model with powerful computational and reasoning capabilities, such as a language model based on the Transformer architecture. Multi-round risk attribution reasoning involves repeatedly invoking the large model to gradually analyze and attribute risks within the dynamic risk association hypergraph. Attack chain fragment matching involves comparing the behavioral hyperedges in the dynamic risk association hypergraph with attack patterns in the security domain knowledge graph to identify possible attack chain fragments. Evidence chain completion involves further supplementing relevant evidence after matching attack chain fragments to complete the evidence chain. A primary risk node refers to the primary node that causes a risk. An associated risk path refers to the path formed by a series of nodes and hyperedges associated with the primary risk node. Evidence confidence refers to the credibility of the evidence at each link. A possible attack chain fragment is a combination of a series of behavioral hyperedges and the entity nodes connected to them in the dynamic risk association hypergraph. These combinations match the key behavioral stages, entity node types, and core behavioral characteristics described in the attack pattern in the security domain knowledge graph. When matching attack chain segments, for example, attack pattern descriptions can be first extracted from a pre-defined security domain knowledge graph and converted into a structured behavioral feature template. This template contains information such as key behavioral stages, entity node types, and core behavioral features. For example, the initial stage corresponds to communication nodes, with the core behavioral feature being unauthorized port connection attempts; the intermediate stage corresponds to interface nodes, with the core behavioral feature being abnormal parameter construction calls; and the subsequent stage corresponds to storage nodes, with the core behavioral feature being permission boundary violations. The entity node set, behavioral hyperedge set, and temporal constraint set of the dynamic risk association hypergraph are then converted into a graph-structured textual description that can be parsed by the large model, serving as the input context for the first round of reasoning. The large model is invoked and, in conjunction with the behavioral feature template, performs the first round of reasoning on the graph-structured textual description. The large model parses the graph-structured textual description to understand the entity nodes, behavioral hyperedges, and temporal constraints contained therein. For each behavioral hyperedge in the behavioral hyperedge set, the model checks whether the connected node type matches the node type in the behavioral feature template and whether the node's behavior conforms to the core behavioral features. If so, the combination of the behavioral hyperedge and its connected nodes is considered a candidate attack chain segment. For example, if it is found that a communication node connected to a behavioral hyperedge has unauthorized port connection behavior, an interface node has abnormal parameter construction and call behavior, and a storage node has signs of being attempted to break through permissions, then these node and hyperedge combinations will be used as candidate attack chain fragments, and finally the entity node sequence and behavioral hyperedge sequence contained in the candidate attack chain fragment will be output.

[0065] As an implementation manner, step S300 may be specifically implemented as the following steps S310-S380: Step S310: Extract attack pattern description, vulnerability feature description and defense rule description from the preset security field knowledge graph, and convert the attack pattern description into a structured behavior feature template.

[0066] An attack pattern description is a detailed description of network attack behavior, including the steps, methods, and targets. A vulnerability feature description describes the characteristics of a vulnerability in a network system, such as its type, scope, and triggering conditions. A defense rule description describes the rules for network security defense measures, such as disabling access to certain ports or restricting certain user operations. Structured behavioral feature templates convert attack pattern descriptions into a structured format, facilitating analysis and matching within large models.

[0067] When extracting relevant descriptions, the attack pattern description, vulnerability feature description, and defense rule description are obtained from the preset security domain knowledge graph through the knowledge graph query interface. The attack pattern description is then processed and converted into a structured behavioral feature template. Natural language processing technology is used to parse the attack pattern description to extract the key behavioral stages in the attack process, the entity node types corresponding to each stage, and the core behavioral features. This information is combined into a structured template, which contains a stage placeholder area, a node type placeholder area, and a behavioral feature placeholder area. In the e-commerce platform, the attack pattern description for the e-commerce system is extracted from the security domain knowledge graph. For example, an attacker may first connect to the server through an unauthorized port, then construct abnormal parameters to call the user interface, and finally break through the database permissions to tamper with the data. This attack pattern description is converted into a structured behavioral feature template.

[0068] As an implementation method, in step S310, converting the attack pattern description into a structured behavioral feature template can be specifically implemented as follows: Step S311: Parse the text content of the attack pattern description and extract the key behavior stages in the attack process. The key behavior stages are behavior sequences arranged in chronological order.

[0069] Parsing is the process of analyzing and understanding the textual content of the attack pattern description to extract useful information. Key behavioral phases are those with significant significance during the attack process, arranged chronologically to form a behavioral sequence.

[0070] When parsing attack pattern descriptions, natural language processing techniques such as word segmentation, part-of-speech tagging, and named entity recognition are used. First, the attack pattern description text is segmented, breaking the text into individual words. Then, part-of-speech tagging determines the part of speech of each word, and named entity recognition identifies the entity type represented by the word. Next, based on the semantics and logical relationships of the text, the key behavioral stages of the attack process are extracted. On an e-commerce platform, the attack pattern is described as "the attacker first attempts to connect to the e-commerce server through an unauthorized port, then constructs abnormal parameters to call the product query interface, and finally breaks through database permissions to modify product prices." Through parsing, the key behavioral stages extracted are "unauthorized port connection attempt," "unauthorized parameter construction and call," and "permission boundary violation operation."

[0071] Step S312: Match the corresponding entity node type for each key behavior stage, wherein the initial stage corresponds to the communication node, the intermediate stage corresponds to the interface node, and the subsequent stage corresponds to the storage node.

[0072] Entity node types refer to the node types in the dynamic risk association hypergraph, including communication nodes, interface nodes, and storage nodes. By matching the corresponding entity node type for each key behavior stage, attack patterns can be associated with nodes in the dynamic risk association hypergraph, facilitating subsequent matching and analysis.

[0073] When matching, key behavior stages are mapped to corresponding entity node types based on their characteristics and nature. On e-commerce platforms, the initial attack phase, "unauthorized port connection attempts," typically involves network communication, corresponding to communication nodes such as the connection between the server and the external network. The intermediate phase, "abnormal parameter construction calls," requires invoking the server's interface for operation, corresponding to interface nodes such as the product query interface. The subsequent phase, "authority boundary breach operations," may involve operations on database data, corresponding to storage nodes such as the product database.

[0074] Step S313: extract the core behavior features of each key behavior stage. The core behavior feature of the initial stage is the unauthorized port connection attempt, the core behavior feature of the middle stage is the abnormal parameter construction call, and the core behavior feature of the subsequent stage is the permission boundary violation operation.

[0075] Core behavioral features refer to the most representative and characteristic behaviors in each key behavioral phase. By extracting core behavioral features, we can more accurately describe attack patterns and facilitate matching with behaviors in the dynamic risk association hypergraph.

[0076] When extracting core behavioral features, the core behaviors of each stage are determined based on the description and analysis of key behavioral stages. On e-commerce platforms, for the initial stage of "unauthorized port connection attempts," the core behavioral feature is attempting to connect to the e-commerce server through an unauthorized port. For the intermediate stage of "abnormal parameter construction and call," the core behavioral feature is constructing abnormal parameters to call the server interface, such as constructing unreasonable product query parameters. For the subsequent stage of "authority boundary violation operations," the core behavioral feature is violating the authority boundaries of the server database and performing illegal data operations, such as modifying product prices.

[0077] Step S314: combining key behavior stages, entity node types, and core behavior features into a structured behavior feature template, wherein the behavior feature template includes a stage placeholder area, a node type placeholder area, and a behavior feature placeholder area.

[0078] Structured behavioral signature templates are a structured representation of attack patterns. By combining key behavioral phases, entity node types, and core behavioral signatures, they facilitate processing and matching with large models. The phase placeholder represents the different phases of an attack, the node type placeholder represents the entity node type corresponding to each phase, and the behavioral signature placeholder represents the core behavioral signature of each phase.

[0079] When assembling a behavioral signature template, fill in the corresponding placeholders for the key behavioral stages, entity node types, and core behavioral features. On e-commerce platforms, a behavioral signature template can be represented as follows: {Stage Placeholder: Initial Stage, Node Type Placeholder: Communication Node, Behavior Feature Placeholder: Unauthorized Port Connection Attempt; Stage Placeholder: Intermediate Stage, Node Type Placeholder: Interface Node, Behavior Feature Placeholder: Abnormal Parameter Construction Call; Stage Placeholder: Subsequent Stage, Node Type Placeholder: Storage Node, Behavior Feature Placeholder: Permission Boundary Violation Operation}.

[0080] Step S320: Convert the entity node set, behavior hyperedge set, and temporal constraint set of the dynamic risk association hypergraph into a graph structure text description that can be parsed by the large model as the input context for the first round of reasoning.

[0081] The textual description of the graph structure describes the entity node set, behavioral hyperedge set, and temporal constraint set of the dynamic risk association hypergraph in text form, making it understandable and processable by the big model. Input context refers to the relevant information provided to the big model during reasoning to guide the model's reasoning process.

[0082] During the conversion, the information of the entity node set is first organized, including node attribute information, such as the transmission direction identifier of the communication node and the operation object path of the storage node. Then, the information of the behavior hyperedge set is organized, including the hyperedge connection nodes and hyperedge weights. Finally, the information of the timing constraint set is organized, including time sequence constraints and time overlap constraints. This information is combined into a graph structure text description according to a specific format. In e-commerce platforms, the JSON format is used to represent the graph structure text description, which includes the attribute information of communication nodes, storage nodes, and interface nodes, the connection nodes and weights of behavior hyperedges, and the timing constraint information. This graph structure text description is provided to the large model as the input context for the first round of reasoning.

[0083] Step S330: Call the large model and perform the first round of reasoning on the graph structure text description in combination with the behavioral feature template to identify the candidate attack chain fragments in the behavioral hyperedge set that match the attack pattern description, and output the entity node sequence and behavioral hyperedge sequence contained in the candidate attack chain fragments.

[0084] Large models are AI models with powerful computing and reasoning capabilities, such as language models based on the Transformer architecture. Behavioral feature templates are structured templates derived from attack pattern descriptions. Candidate attack chain segments are combinations of behavioral hyperedges in the dynamic risk association hypergraph that may match the attack pattern description. Entity node sequences are the sequentially arranged sequences of the entity nodes involved in a candidate attack chain segment. Behavioral hyperedge sequences are the sequentially arranged sequences of the behavioral hyperedges involved in a candidate attack chain segment.

[0085] When the large model is invoked for the first round of inference, it receives a textual description of the graph structure and a behavioral feature template as input. The large model first parses the graph structure description to understand information such as entity nodes, behavioral hyperedges, and timing constraints. Then, combining the key behavioral phases, entity node types, and core behavioral features in the behavioral feature template, it analyzes each behavioral hyperedge set individually. For each behavioral hyperedge, the model checks whether the connected node type matches the node type in the behavioral feature template and whether the node's behavior conforms to the core behavioral features. If so, the behavioral hyperedge and its connected node combination are considered candidate attack chain segments. Finally, the model outputs the entity node sequence and behavioral hyperedge sequence contained in the candidate attack chain segment. For e-commerce platforms, the large model analyzes the graph structure description of the platform's dynamic risk association hypergraph and, combined with the behavioral feature template specific to the e-commerce system, identifies possible attack chain segments. For example, if a communication node connected to a behavioral hyperedge is found to have unauthorized port connections, an interface node has abnormal parameter construction calls, or a storage node shows signs of attempted privilege evasion, the model identifies these node and hyperedge combinations as candidate attack chain segments and outputs the corresponding entity node sequence and behavioral hyperedge sequence.

[0086] Step S340: The candidate attack chain fragment output by the first round of reasoning is used as the input of the second round of reasoning. The large model is called to match the vulnerability features of the entity nodes in the candidate attack chain fragment in combination with the vulnerability feature description, and the entity nodes with vulnerability features are determined as potential risk nodes.

[0087] A vulnerability signature is a detailed description of network vulnerability characteristics within the security domain knowledge graph, including the vulnerability's impact node type, triggering behavior description, and severity of harm description. Potential risk nodes are entity nodes within candidate attack chain segments that exhibit behaviors or attributes matching the vulnerability signature description. These nodes may present network security risks due to vulnerabilities.

[0088] During the second round of inference, the large model receives candidate attack chain segments and vulnerability feature descriptions as input. The large model first performs a detailed analysis of the entity nodes in the candidate attack chain segments, determining each node's type, such as communication node, interface node, or storage node. Then, based on the node type, it filters vulnerability-related information matching that type from the vulnerability feature description. For each entity node, it extracts its behavioral atomic features and calculates semantic similarity with the triggering behavior descriptions in the filtered vulnerability-related information. If the semantic similarity is high, it indicates that the entity node's behavior may trigger the corresponding vulnerability. The entity node is marked as an entity node with vulnerability features, and the corresponding vulnerability-related information and damage severity are recorded. In the e-commerce platform, the candidate attack chain segments include a communication node, an interface node, and a storage node. Based on the node type, the large model filters vulnerability information for the communication node, interface node, and storage node from the vulnerability feature description. For the communication node, it extracts its behavioral atomic features (such as unauthorized port connection attempts) and compares them with the triggering behavior descriptions in the communication node vulnerability information. If a high match is found, the communication node is marked as a potential risk node, and the corresponding vulnerability information and damage severity are recorded.

[0089] As an implementation manner, step S340 may be specifically implemented as the following steps S341-S345: Step S341: extract vulnerability related information from the vulnerability feature description, where each vulnerability related information includes the affected node type, triggering behavior description, and damage degree description.

[0090] Vulnerability-related information refers to various information related to network vulnerabilities, including the types of nodes affected by the vulnerability, descriptions of behaviors that can trigger the vulnerability, and descriptions of the degree of harm that the vulnerability may cause.

[0091] When extracting vulnerability-related information, natural language processing technology is used to parse the vulnerability feature description. First, the text of the vulnerability feature description is segmented and the text is split into words. Then, the part of speech and entity type of each word are determined through part-of-speech tagging and named entity recognition. Next, based on the semantics and logical relationships of the text, the affected node type, triggering behavior description, and hazard level description are extracted. In the e-commerce platform, the vulnerability feature description is "A certain vulnerability affects the communication node. When an unauthorized port connection occurs and lasts for a period of time, it will be triggered, which may cause the server to crash and the degree of harm is high." Through parsing, the affected node type is extracted as "communication node", the triggering behavior description is "unauthorized port connection and lasts for a period of time", and the hazard level is described as "high".

[0092] Step S342: Perform type identification on the entity nodes in the candidate attack chain fragment to determine the node type of each entity node. The node types include communication nodes, storage nodes, and interface nodes.

[0093] Type identification involves classifying and judging the entity nodes in a candidate attack chain segment, determining whether they are communication nodes, storage nodes, or interface nodes. By determining the node type, nodes that match the vulnerability signature can be more accurately selected.

[0094] When performing type identification, judgment is made based on the attribute information of the entity node. Communication nodes generally have attributes related to network communication, such as transmission direction identifier and payload length sequence. Storage nodes have attributes related to data storage, such as access subject identifier and operation object path. Interface nodes have attributes related to interface calls, such as interface identifier and input parameter summary. In the e-commerce platform, for a node in the candidate attack chain fragment, if its attributes include transmission direction identifier and payload length sequence, it is judged to be a communication node; if its attributes include access subject identifier and operation object path, it is judged to be a storage node; if its attributes include interface identifier and input parameter summary, it is judged to be an interface node.

[0095] Step S343: According to the node type of the entity node, vulnerability related information matching the type is filtered out from the vulnerability feature description to obtain a node type matching vulnerability information set.

[0096] The node type matching vulnerability information set is a collection of vulnerability-related information that matches the entity node type, filtered from the vulnerability feature description. This filtering can reduce unnecessary matching work and improve matching efficiency.

[0097] During the screening process, each entity node in the candidate attack chain segment is traversed, and matching vulnerability information is found from the vulnerability feature description based on its node type. On the e-commerce platform, for a communication node, vulnerability information related to the communication node type is filtered from the vulnerability feature description and combined into a node type matching vulnerability information set.

[0098] Step S344: extracting the behavior atomic features of the entity nodes in the candidate attack chain fragment, performing semantic similarity calculation on the behavior atomic features and the triggering behavior description of each vulnerability-related information in the node type matching vulnerability information set, and obtaining the behavior matching result.

[0099] Semantic similarity calculation is the calculation of the semantic similarity between two texts. Behavior matching results are obtained by comparing the semantic similarity between the behavior atomic features of an entity node and the triggering behavior description of vulnerability-related information. This is used to determine whether the entity node's behavior is likely to trigger a vulnerability.

[0100] When calculating semantic similarity, a text similarity algorithm from natural language processing is used. First, the entity node's behavioral atomic features and the description of the triggering behavior of the vulnerability-related information are segmented to convert the text into a word set. Semantic similarity is then determined by calculating the similarity between the word sets. A high semantic similarity indicates that the behavioral atomic features and the triggering behavior description are semantically similar, and the entity node's behavior may trigger the corresponding vulnerability. On an e-commerce platform, the entity node's behavioral atomic feature is "attempting to connect to the server through an unauthorized port," and the node type matches a vulnerability-related information in the vulnerability information set, which has a triggering behavior description of "unauthorized port connection attempt." A text similarity algorithm is used to calculate the semantic similarity between the two and obtain a behavioral matching result.

[0101] Step S345: Mark the entity node corresponding to the vulnerability-related information with highly similar behavior matching results as an entity node with vulnerability characteristics, and record the vulnerability-related information and hazard level description of the entity node to generate a potential risk node list.

[0102] The potential risk node list is a list of entity nodes with vulnerability characteristics, including node identification, vulnerability-related information, and a description of the degree of harm. Generating a potential risk node list facilitates subsequent risk analysis and processing.

[0103] When generating a list of potential risk nodes, the entity nodes in the candidate attack chain fragments are traversed, and for each entity node, the behavior matching results are checked. If the behavior matching result is highly similar, the entity node is marked as an entity node with vulnerability characteristics. Then, the vulnerability-related information corresponding to the entity node (such as the affected node type, triggering behavior description) and the degree of harm description are recorded. This marked node information is combined into a list of potential risk nodes. On an e-commerce platform, after a semantic similarity calculation, it is found that the behavioral atomic characteristics of a communication node are highly similar to the triggering behavior description of a vulnerability. The communication node is marked as an entity node with vulnerability characteristics, and its corresponding vulnerability information and degree of harm are recorded and added to the list of potential risk nodes.

[0104] Step S350: Use the potential risk node and the corresponding candidate attack chain fragment as the input of the third round of reasoning, call the large model and combine it with the defense rule description to perform abnormality assessment on the behavioral hyperedge of the potential risk node, generate an abnormality assessment result, and mark the potential risk node with a high risk in the abnormality assessment result as the main cause risk node.

[0105] Defense rule descriptions describe network security defense measures within the security domain knowledge graph, such as disabling access to certain ports or restricting certain user operations. Abnormality assessment analyzes and determines the behavioral hyperedges of potential risk nodes, assessing whether they violate defense rules and whether they exhibit abnormal behavior. Abnormality assessment results are obtained by evaluating the abnormality of the behavioral hyperedges of potential risk nodes, such as high risk, medium risk, or low risk. Primary risk nodes are the primary nodes that cause risks. By marking potential risk nodes with high-risk abnormality assessment results as primary risk nodes, the root cause of the risk can be more accurately identified.

[0106] During the third round of reasoning, the large model receives as input the potential risk node, the corresponding candidate attack chain fragment, and the defense rule description. The large model first parses the defense rule description to understand the rules. Then, for each potential risk node, the model checks whether its behavioral hyperedge violates the defense rule. For example, a defense rule may prohibit connections through unauthorized ports. If a potential risk node's behavioral hyperedge involves an operation connecting through an unauthorized port, the behavioral hyperedge may be assessed as high risk. Potential risk nodes with an anomaly assessment result of high risk are marked as primary risk nodes. On e-commerce platforms, defense rules prohibit unauthorized users from calling certain key interfaces. The large model analyzes the behavioral hyperedges of potential risk nodes and finds that an interface node's behavioral hyperedge involves an unauthorized user calling a key interface. The model marks the interface node's anomaly assessment result as high risk and marks it as the primary risk node.

[0107] Step S360: Tracing the behavior hyperedge connection path in the dynamic risk association hypergraph based on the main cause risk node to generate an associated risk path including the main cause risk node, associated entity nodes and behavior hyperedge sequence.

[0108] A correlation risk path is a path formed by tracing the path of connected entity nodes and behavioral hyperedges from the primary risk node through the behavioral hyperedges in the dynamic risk correlation hypergraph. By generating correlation risk paths, we can gain a more comprehensive understanding of the spread and impact of risks.

[0109] As an implementation manner, step S360 can be specifically implemented as the following steps S361-S365: Step S361: Taking the main cause risk node as the starting search point, search for behavior hyperedges directly connected to the starting search point in the dynamic risk association hypergraph to obtain first-level association hyperedges.

[0110] The starting retrieval point is the primary risk node, which serves as the starting point for the traceable behavior hyperedge connection path. A first-level associated hyperedge refers to a behavior hyperedge directly connected to the primary risk node.

[0111] During the search, all hyperedges connected to the primary risk node are searched in the dynamic risk association hypergraph. On the e-commerce platform, if the primary risk node is a user interface node, all hyperedges connected to the user interface node are searched in the hypergraph and regarded as first-level association hyperedges.

[0112] Step S362: For each first-level associated hyperedge, extract other entity nodes connected to the hyperedge as first-level associated nodes, and record the weight value of the first-level associated hyperedge and the corresponding timing constraint relationship.

[0113] First-level association nodes refer to all entity nodes connected by first-level association hyperedges, excluding the primary risk node. Weights refer to the combined weight of a first-level association hyperedge, reflecting its importance. Temporal constraints refer to the temporal precedence and temporal overlap constraints imposed on a first-level association hyperedge.

[0114] When extracting first-level association nodes, for each first-level association hyperedge, identify the entity nodes connected to it, in addition to the primary risk node. At the same time, record the weight value of the first-level association hyperedge, which is the previously calculated combined weight. It is also necessary to record the timing constraints corresponding to the first-level association hyperedge. These constraints were determined when the timing constraint set was generated. On an e-commerce platform, a first-level association hyperedge connects the primary risk node (user interface node) and a storage node. This storage node is used as the first-level association node, and the weight value and corresponding timing constraints of the hyperedge are recorded.

[0115] Step S363: Using the first-level association node as a new starting point, repeat the above search process until the boundary node of the dynamic risk association hypergraph is retrieved or the preset search depth limit is reached, and multi-level association hyperedges and multi-level association nodes are obtained.

[0116] A boundary node is a node on the edge of the dynamic risk association hypergraph, potentially a node with no further connections. The preset search depth limit is a pre-set limit on the search depth, used to control the scope of the search. A multi-level association hyperedge is an association hyperedge of different levels obtained through multiple searches. A multi-level association node is an association node of different levels connected by a multi-level association hyperedge.

[0117] When searching with a first-level association node as the new starting point, repeat steps S361 and S362. For each first-level association node, search for connected behavioral hyperedges in the dynamic risk association hypergraph to obtain new association hyperedges (second-level association hyperedges). Extract the other entity nodes connected by these hyperedges as second-level association nodes. Continue searching with a second-level association node as the starting point and repeat the above process until a boundary node is found or the preset search depth limit is reached. On the e-commerce platform, starting with the first-level association node (storage node), search for connected hyperedges to obtain second-level association hyperedges and second-level association nodes. Repeat this process until the termination condition is met, resulting in multiple levels of association hyperedges and nodes.

[0118] Step S364: sorting the multi-level associated hyperedges in time sequence according to the time sequence constraint relationship in the timing constraint set, and generating a behavior hyperedge sequence arranged in time sequence.

[0119] Temporal ordering is the process of arranging multi-level hyperedges according to the temporal order constraints in the temporal constraint set, so that the hyperedges are arranged in the order of their occurrence. A behavioral hyperedge sequence is a sequence of multi-level hyperedges arranged in chronological order.

[0120] When performing chronological sorting, first obtain the temporal order constraints of multi-level hyperedges from the temporal constraint set. Then, sort the multi-level hyperedges based on these constraints. Sorting algorithms, such as bubble sort or quick sort, can be used to sort the hyperedges. In e-commerce platforms, based on the temporal constraint set, it is known that certain multi-level hyperedges have temporal order relationships, such as hyperedge A must occur before hyperedge B. These hyperedges are then sorted using a sorting algorithm to generate a chronological sequence of behavioral hyperedges.

[0121] Step S365: Arrange the main cause risk nodes and multi-level associated nodes according to the connection relationship of the behavior hyperedge sequence to generate an associated risk path including the node sequence and the corresponding behavior hyperedge sequence.

[0122] The associated risk path is a path formed by arranging the main risk nodes and multi-level associated nodes according to the connection relationship of the behavioral hyperedge sequence, which includes the order of the nodes and the corresponding behavioral hyperedge sequence.

[0123] When generating an associated risk path, the primary risk node and multi-level associated nodes are arranged sequentially according to the connectivity of the behavioral hyperedge sequence. For each behavioral hyperedge, the order of the nodes it connects is recorded. On e-commerce platforms, the behavioral hyperedge sequence connects the primary risk node (user interface node), the first-level associated node (storage node), and the second-level associated node (server node). These nodes are arranged sequentially according to the connectivity of the behavioral hyperedge sequence to generate an associated risk path containing the node order (user interface node -> storage node -> server node) and the corresponding behavioral hyperedge sequence.

[0124] Step S370: Calculate the product of the weight value of each behavior hyperedge in the associated risk path and the anomaly assessment result as the evidence confidence of each link on the path.

[0125] Evidence confidence refers to the credibility of evidence in each link on the associated risk path, which is obtained by calculating the product of the weight value of the behavioral hyperedge and the anomaly assessment result.

[0126] When calculating the evidence confidence, for each behavioral hyperedge in the associated risk path, a weight value is obtained. This weight value is the previously calculated combined weight. Simultaneously, the anomaly assessment result corresponding to the behavioral hyperedge is obtained. The anomaly assessment result can be expressed as a numerical value or level representing the degree of risk. The weight value is multiplied by the anomaly assessment result to obtain the evidence confidence corresponding to the behavioral hyperedge. On e-commerce platforms, a behavioral hyperedge has a certain weight value and a high-risk anomaly assessment result. Multiplying these two values ​​together yields the evidence confidence for the behavioral hyperedge.

[0127] Step S380: Integrate the main risk node, associated risk path and the confidence of evidence of each link in the order of reasoning to generate a risk attribution reasoning chain.

[0128] The risk attribution reasoning chain is a chain formed by integrating the main risk nodes, related risk paths and the confidence of evidence in each link in the order of reasoning, which is used to clearly demonstrate the risk attribution process and related information.

[0129] When integrating, the order of reasoning is first determined, usually starting from the primary risk node and gradually expanding along the associated risk path. Place the primary risk node at the beginning of the reasoning chain, then list the nodes and behavioral hyperedges in the associated risk path in sequence, and list the evidence confidence of each link accordingly. In e-commerce platforms, the primary risk nodes (such as user interface nodes with abnormal operations) are listed first, and then, in the order of the associated risk path, the associated nodes at all levels (such as storage nodes, server nodes, etc.) and the behavioral hyperedges connecting them are listed in sequence. For each node and hyperedge, the corresponding evidence confidence is attached. This forms a complete risk attribution reasoning chain, which clearly shows how the risk propagates through a series of nodes and hyperedges starting from the primary risk node, as well as the credibility of each link. For example, the reasoning chain may be presented as: main cause risk node (user interface node, evidence confidence is relatively high) -> first-level association hyperedge (connecting user interface node and storage node, evidence confidence is a certain degree) -> first-level association node (storage node, evidence confidence is a certain degree) -> second-level association hyperedge (connecting storage node and server node, evidence confidence is a certain degree) -> second-level association node (server node, evidence confidence is a certain degree).

[0130] Step S400: Based on the risk attribution reasoning chain and the temporal constraint set of the dynamic risk association hypergraph, a risk evolution probability model is constructed, and based on this, the short-term diffusion probability and long-term evolution trend vector of each associated risk path are calculated to obtain the risk evolution path prediction result.

[0131] The risk evolution probability model describes how risks evolve and propagate within a network. It combines the risk attribution reasoning chain with the temporal constraints of a dynamic risk hypergraph, taking into account information such as the risk propagation path, time factors, and the credibility of each link. The short-term diffusion probability refers to the likelihood that the associated risk path will spread within a short period of time, reflecting the near-term risk propagation trend. The long-term evolution trend vector describes the evolution direction and rate of the associated risk path over a longer period of time and is used to predict the long-term development of the risk. The risk evolution path prediction results, derived from a combination of the short-term diffusion probability and the long-term evolution trend vector, are used to guide network security prevention and response measures.

[0132] On e-commerce platforms, the risk attribution reasoning chain shows that risk propagates from user interface nodes to storage nodes and server nodes via a series of behavioral hyperedges, with each link having a corresponding level of evidence confidence. Furthermore, a set of temporal constraints specifies the temporal order and time intervals of these behavioral hyperedges. This information is used to construct path state transition relationships, which are then adjusted for time decay to account for the impact of time on risk propagation. For example, if the time interval between two behavioral hyperedges is long, the probability of risk transferring from one hyperedge to another decreases accordingly. Based on this adjusted state transition relationship, a risk evolution probability model is constructed. This model calculates the short-term diffusion probability and long-term evolution trend vector for each associated risk path, resulting in a risk evolution path prediction.

[0133] As an implementation manner, step S400 may be specifically implemented as the following steps S410-S470: Step S410: extract the associated risk path and the evidence confidence of each link from the risk attribution reasoning chain, and extract the timing constraint relationship corresponding to the associated risk path from the timing constraint set of the dynamic risk association hypergraph.

[0134] An associated risk path is a risk propagation path represented in a risk attribution reasoning chain, consisting of a series of entity nodes and behavioral hyperedges. The evidence confidence level for each link represents the credibility information associated with each node and hyperedge in the risk attribution reasoning chain. A temporal constraint is a constraint condition in a dynamic risk association hypergraph that specifies the temporal sequence and time intervals of behavioral hyperedges along the associated risk path.

[0135] When extracting this information, the risk attribution reasoning chain is analyzed in detail to identify the associated risk paths, and the entity nodes and behavioral hyperedges in the path are recorded sequentially. At the same time, the evidence confidence level corresponding to each node and hyperedge is extracted. For the temporal constraint set of the dynamic risk association hypergraph, the temporal constraint relationships corresponding to the associated risk paths are screened out. These relationships may include temporal precedence constraints and temporal overlap constraints. In the e-commerce platform, the associated risk path from the user interface node to the storage node and then to the server node is extracted from the risk attribution reasoning chain, along with the evidence confidence level of each node and hyperedge. The temporal precedence relationship and time interval information of the behavioral hyperedges on the associated risk path are extracted from the temporal constraint set.

[0136] Step S420: Based on the behavior hyperedge sequence and evidence confidence in the associated risk path, a path state transition relationship is constructed. The path state transition relationship represents the probability value of transitioning from one behavior hyperedge to the next behavior hyperedge, which is determined by the product of the evidence confidence of the current behavior hyperedge and the hyperedge weight.

[0137] The path state transition relationship describes the probability of risk transferring from one behavioral hyperedge to the next along the associated risk path. A behavioral hyperedge sequence is a sequence of behavioral hyperedges in the associated risk path. The evidence confidence reflects the credibility of each behavioral hyperedge, and the hyperedge weight indicates the importance of the behavioral hyperedge.

[0138] When constructing a path state transition relationship, for each behavior hyperedge in the associated risk path, its evidence confidence is multiplied by the hyperedge weight to obtain the probability value of transitioning from that behavior hyperedge to the next behavior hyperedge. For example, in the associated risk path of an e-commerce platform, the first behavior hyperedge connects the user interface node and the storage node. Its evidence confidence is a certain level, and its hyperedge weight is a certain level. Multiplying these two together yields the probability value of transitioning from this hyperedge to the next behavior hyperedge connecting the storage node and the server node. This calculation is performed sequentially for each behavior hyperedge in the associated risk path to construct a complete path state transition relationship.

[0139] Step S430: combining the time interval information in the timing constraint relationship, performing time attenuation adjustment on the path state transition relationship to generate a time-aware state transition relationship.

[0140] Time interval information is the time interval between adjacent behavior hyperedges on the associated risk path specified in the temporal constraint. Time decay adjustment adjusts the path state transition relationship to account for the impact of time on the likelihood of risk propagation. Time-aware state transition relationships are state transition relationships that, after time decay adjustment, can reflect the impact of time on risk transfer.

[0141] On e-commerce platforms, the time intervals between adjacent behavioral hyperedges on an associated risk path may vary. For example, there may be a certain time interval between the behavioral hyperedge from the user interface node to the storage node and the behavioral hyperedge from the storage node to the server node. Based on a preset time decay coefficient table, the time decay coefficient corresponding to this time interval is determined. The previously calculated probability value in the path state transition relationship is multiplied by this coefficient to obtain the time-attenuated transition probability value. These values ​​are normalized to a reasonable range and then updated into the path state transition relationship to generate a time-aware state transition relationship.

[0142] As an implementation manner, step S430 may be specifically implemented as the following steps S431-S434: Step S431: extracting the time interval information in the timing constraint relationship, and determining the occurrence time interval of adjacent behavior hyperedges in the associated risk path.

[0143] Time interval information is the difference in the occurrence time of adjacent behavior hyperedges on the associated risk path recorded in the temporal constraint relationship. By extracting this information, we can understand the time interval of risk propagation between different behavior hyperedges.

[0144] When extracting time interval information, analyze the timing constraint relationships corresponding to the associated risk path in the timing constraint set. Find the occurrence timestamps of adjacent behavior hyperedges and calculate their difference to obtain the time interval. In e-commerce platforms, for adjacent behavior hyperedges on the associated risk path, obtain their occurrence timestamps from the timing constraint set and calculate the time interval, for example, the time interval between a behavior hyperedge connecting a user interface node and a storage node and another behavior hyperedge connecting a storage node and a server node.

[0145] Step S432: Based on a preset time attenuation coefficient table, a corresponding time attenuation coefficient is determined according to the time interval information. The longer the time interval, the smaller the corresponding time attenuation coefficient.

[0146] The preset time decay coefficient table is a pre-set table that records the time decay coefficients corresponding to different time intervals. The time decay coefficient is used to adjust the probability value in the path state transition relationship, reflecting the impact of time factors on risk propagation.

[0147] When determining the time decay coefficient, the corresponding coefficient is searched in a preset time decay coefficient table based on the time interval information obtained in step S431. Because the longer the time interval, the less likely the risk will continue to spread during this period, the longer the time interval, the smaller the corresponding time decay coefficient. On e-commerce platforms, if the time interval between adjacent behavior hyperedges is long, the coefficient corresponding to this time interval in the time decay coefficient table will be relatively small.

[0148] Step S433: multiplying the possibility value in the path state transition relationship by the corresponding time decay coefficient to obtain a transition possibility value after time decay.

[0149] The probability value in the path state transition relationship is the previously calculated probability of transitioning from one behavior hyperedge to the next. Multiplying this probability value by the corresponding time decay coefficient yields the adjusted probability value for the transition, taking time into account.

[0150] During the multiplication operation, for each behavior hyperedge in the associated risk path, the probability value of the corresponding path state transition relationship is multiplied by the time decay coefficient determined in step S432. In the e-commerce platform, for a behavior hyperedge connecting a user interface node and a storage node, the probability value of the transition to the next behavior hyperedge is multiplied by the corresponding time decay coefficient to obtain the time-decayed transition probability value.

[0151] Step S434: normalize the time-attenuated transition probability values, and update the normalized transition probability values ​​into the path state transition relationship to generate a time-aware state transition relationship.

[0152] Normalization adjusts the time-attenuated transition probability values ​​to a uniform range, making them comparable and reasonable. Updating the path state transition relationship replaces the original probability values ​​with the normalized transition probability values, forming a time-aware state transition relationship that reflects the influence of time factors.

[0153] During normalization, a normalization algorithm is used to process the time-attenuated transition probability values. Normalization involves mapping these values ​​to a set interval, such as [0, 1]. The normalized transition probability values ​​are then updated to the path state transition relation, replacing the original probability values. On the e-commerce platform, the time-attenuated transition probability values ​​of all adjacent behavior hyperedges are normalized and updated to the path state transition relation, generating a time-aware state transition relation.

[0154] Step S440: Construct a risk evolution probability model based on the time-aware state transition relationship. The risk evolution probability model includes a short-term prediction layer and a long-term prediction layer. The short-term prediction layer is used to predict the risk diffusion within a first preset time period in the future, and the long-term prediction layer is used to predict the risk evolution within a second preset time period in the future.

[0155] The risk evolution probability model is a comprehensive model used to predict the evolution and spread of risks over different time periods. The short-term and long-term forecast layers are two components of the model, responsible for forecasting at different time scales.

[0156] When constructing a risk evolution probability model, the foundation is time-aware state transition relationships. Using these time-aware state transition relationships as input to the model, a series of calculations and processing constructs short-term and long-term prediction layers. The short-term prediction layer predicts the spread of risk along associated risk paths within a first preset time period in the future based on the current state and state transition relationships, including information on which nodes the risk might spread to and the likelihood of such spread. The long-term prediction layer considers a longer timeframe, predicting the direction and rate of risk evolution within a second preset time period. On e-commerce platforms, a risk evolution probability model based on time-aware state transition relationships can help predict whether risks will spread from the current node to other nodes in the short term, as well as the overall risk development trend over a longer period.

[0157] Step S450: Calculate the diffusion possibility value of each associated risk path in the first preset time period in the future through the short-term prediction layer as the short-term diffusion probability.

[0158] The short-term diffusion probability refers to the likelihood that an associated risk path will spread within the first preset time period in the future. The short-term prediction layer uses information from the risk evolution probability model and combines it with time-aware state transition relationships to analyze and calculate each associated risk path.

[0159] On an e-commerce platform, for an associated risk path, its current state (e.g., a behavior hyperedge connecting a user interface node and a storage node with a certain level of evidence confidence) and its time-aware state transition relationship are input into the short-term prediction layer. Based on the state transition relationship, the transition calculation module calculates the transition probability from the current state to the next possible state (e.g., a behavior hyperedge connecting a storage node and a server node). This transition probability is multiplied by the evidence confidence of the current behavior hyperedge to obtain a single-step diffusion probability value. All single-step diffusion probability values ​​within a first preset time period in the future are cumulatively summed to obtain a total diffusion probability value. This total diffusion probability value is converted into a probability value within a preset numerical range using a preset conversion method, which serves as the short-term diffusion probability of the associated risk path. For example, the calculation of the transition probability can be based on the path state transition relationship, which represents the probability value of transitioning from one behavior hyperedge to the next. This probability value is determined by the product of the evidence confidence of the current behavior hyperedge and the hyperedge weight. For example, the associated risk path and the evidence confidence of each link are first extracted from the risk attribution reasoning chain. The corresponding temporal constraint relationships of the associated risk path are then extracted from the temporal constraint set of the dynamic risk association hypergraph. Based on the behavior hyperedge sequence and evidence confidence in the associated risk path, a path state transition relationship is constructed. For each behavior hyperedge in the associated risk path, its evidence confidence is multiplied by the hyperedge weight to obtain the initial transition probability value from that behavior hyperedge to the next behavior hyperedge. Then, time decay adjustment is performed on the path state transition relationship based on the time interval information in the temporal constraint relationship. Time interval information is extracted from the temporal constraint relationship to determine the time interval between adjacent behavior hyperedges in the associated risk path. Based on a preset time decay coefficient table, the corresponding time decay coefficient is determined based on the time interval information. Longer time intervals correspond to smaller time decay coefficients. The initial transition probability value in the path state transition relationship is multiplied by the corresponding time decay coefficient to obtain the time-attenuated transition probability value. The time-attenuated transition probability value is normalized and updated to the path state transition relationship, generating a time-aware state transition relationship. The transition calculation module calculates the transition probability based on this time-aware state transition relationship. When the associated risk path is in the current state, the normalized transition probability value from the current behavior hyperedge to the next possible behavior hyperedge is searched in the time-aware state transition relationship. This value is the transition probability from the current state to the next possible state. For example, if the current associated risk path is on a behavior hyperedge connecting the user interface node and the storage node, the transition calculation module searches the time-aware state transition relationship for the normalized transition probability value from this hyperedge to the behavior hyperedge connecting the storage node and the server node, and uses this as the transition probability.

[0160] As an implementation manner, step S450 may be specifically implemented as the following steps S451-S456: Step S451: input the current state of the associated risk path and the time-aware state transition relationship into the short-term prediction layer, which includes a state input module, a transition calculation module and a probability output module.

[0161] The current state of the associated risk path describes the location and status of the risk at the current moment, including the current behavior hyperedge identifier and the corresponding evidence confidence. The time-aware state transition relationship reflects the probability of risk transfer between different behavior hyperedges after accounting for time. The state input module of the short-term prediction layer receives this information. The transition calculation module calculates the transition probability based on the input information. The probability output module outputs the final short-term diffusion probability.

[0162] When inputting information, the current state information of the associated risk path is accurately transmitted to the state input module. Simultaneously, the time-aware state transition relationship is also input into the short-term prediction layer. In the e-commerce platform, the behavior hyperedge connecting the user interface node and the storage node of the associated risk path, along with the evidence confidence of this hyperedge, is input into the state input module of the short-term prediction layer, along with the time-aware state transition relationship.

[0163] Step S452: Receive the current state of the associated risk path through the state input module, where the current state includes the current behavior hyperedge identifier and the corresponding evidence confidence.

[0164] The state input module is a module in the short-term prediction layer specifically used to receive the current state information of the associated risk path. It processes the received current behavior hyperedge identifier and the corresponding evidence confidence to provide a basis for subsequent transition probability calculation.

[0165] When receiving the current state, the state input module verifies and organizes the input information to ensure its accuracy and completeness. In e-commerce platforms, the state input module receives the current behavior hyperedge identifier associated with the risk path (such as the set identifier of the behavior hyperedge connecting the user interface node and the storage node) and the corresponding evidence confidence level (such as a certain degree of credibility).

[0166] Step S453: Calculate the transition probability of the current state to the next possible state based on the time-aware state transition relationship through the transition calculation module.

[0167] The transition calculation module is responsible for calculating transition probabilities in the short-term prediction layer. It calculates the probability of transitioning from the current state to the next possible state based on the time-aware state transition relationship and the current state of the associated risk path.

[0168] When calculating transition probabilities, the transition calculation module searches the time-aware state transition relationship for the transition probability value corresponding to the current behavior hyperedge. For example, in an e-commerce platform, based on the current behavior hyperedge connecting the user interface node and the storage node, the module searches the time-aware state transition relationship for the transition probability value of the hyperedge to the next behavior hyperedge connecting the storage node and the server node, and uses this value as the transition probability.

[0169] Step S454: Multiply the transition probability by the evidence confidence of the current behavior hyperedge to obtain a single-step diffusion possibility value.

[0170] The single-step diffusion probability value reflects the probability of risk transfer in one step under the current state. By multiplying the transfer probability with the evidence confidence of the current behavior hyperedge, the possibility of transfer and the credibility of the current state can be comprehensively considered.

[0171] During the multiplication operation, the transition probability obtained in step S453 is multiplied by the evidence confidence of the current behavior hyperedge received in step S452. In the e-commerce platform, the transition probability of transferring from the behavior hyperedge connecting the user interface node and the storage node to the behavior hyperedge connecting the storage node and the server node is multiplied by the evidence confidence of the behavior hyperedge connecting the user interface node and the storage node to obtain the single-step diffusion probability value.

[0172] Step S455: cumulatively summing all single-step diffusion possibility values ​​within a first preset time period in the future to obtain a total diffusion possibility value.

[0173] The total diffusion probability value is the overall probability of risk diffusion within the first preset time period in the future. By cumulatively summing all single-step diffusion probability values, we can obtain the comprehensive probability of risk diffusion from the current state within that time period.

[0174] When performing the cumulative summation, for each possible state transition within the first preset time period in the future, the single-step diffusion probability value is calculated and summed. On the e-commerce platform, multiple possible state transitions on the associated risk path within the first preset time period in the future are considered, and the single-step diffusion probability values ​​of each transition are accumulated to obtain the total diffusion probability value.

[0175] Step S456: The total diffusion probability value is converted into a probability value within a preset numerical range through a sigmoid function as the short-term diffusion probability.

[0176] The preset numerical interval, for example, [0, 1], represents the range of the probability of risk diffusion. During the conversion, the total diffusion probability value is processed using a preset conversion rule or algorithm. On the e-commerce platform, the total diffusion probability value obtained through cumulative summation is converted to a probability value within the interval [0, 1] using a sigmoid function, which serves as the short-term diffusion probability of the associated risk path within a first preset future time period.

[0177] Step S460: Calculate the evolution direction and rate of each associated risk path in a second preset time period in the future through the long-term prediction layer as a long-term evolution trend vector.

[0178] The long-term evolution trend vector describes the evolution direction and rate of the associated risk path within a second preset time period. The long-term prediction layer uses information from the risk evolution probability model, combined with time-aware state transition relationships and the historical behavior hyperedge sequence of the associated risk paths, to analyze and calculate each associated risk path.

[0179] On e-commerce platforms, for an associated risk path, its historical behavioral hyperedge sequence (e.g., the order and status of behavioral hyperedges connecting user interface nodes, storage nodes, and server nodes) and time-aware state transition relationships are input into the long-term prediction layer. The sequence encoding module encodes the historical behavioral hyperedge sequence to generate a historical evolution feature vector. Based on this vector and the state transition relationships, the trend prediction module predicts the probability of occurrence of each possible behavioral hyperedge within a second preset time period. The top several behavioral hyperedges with the highest probability are selected as the main evolution directions, and the average interval between these occurrences is calculated as the evolution rate. The main evolution direction and evolution rate are combined to form a long-term evolution trend vector.

[0180] As an implementation manner, step S460 may be specifically implemented as the following steps S461-S466: Step S461: Input the historical behavior hyperedge sequence and time-aware state transition relationship of the associated risk path into the long-term prediction layer, which includes a sequence encoding module, a trend prediction module and a vector generation module.

[0181] The historical behavioral hyperedge sequence of associated risk paths records the past propagation paths and order of risk, reflecting the historical evolution of risk. Time-aware state transition relationships reflect the likelihood of risk transfer between different behavioral hyperedges after accounting for time. The sequence encoding module of the long-term prediction layer encodes the historical behavioral hyperedge sequence. The trend prediction module performs trend prediction based on the encoded information and state transition relationships. The vector generation module generates the final long-term evolution trend vector.

[0182] When inputting information, the historical behavior hyperedge sequences and time-aware state transition relationships associated with risk paths are accurately passed to the long-term prediction layer. In e-commerce platforms, the historical behavior hyperedge sequences associated with risk paths (such as the behavior hyperedge sequences connecting user interface nodes to storage nodes and then to server nodes) and time-aware state transition relationships are input to the long-term prediction layer.

[0183] Step S462: Perform temporal encoding on the historical behavior hyperedge sequence through the sequence encoding module to generate a historical evolution feature vector.

[0184] The sequence encoding module is a module in the long-term prediction layer specifically used to encode the historical behavior hyperedge sequence. It analyzes and processes the behavior hyperedges in the sequence, taking into account their temporal order and characteristics, and generates a feature vector that reflects the historical evolution.

[0185] During temporal encoding, the sequence encoding module extracts and quantifies the features of each hyperedge in the historical hyperedge sequence, combining these features into a vector. For example, it considers information such as the hyperedge's connecting nodes, hyperedge weight, and occurrence time. On e-commerce platforms, the sequence encoding module encodes the historical hyperedge sequence of associated risk paths, quantifies and combines the relevant features of each hyperedge, and generates a historical evolution feature vector.

[0186] Step S463: The trend prediction module predicts the occurrence probability of each possible behavior hyperedge within a second preset time period in the future based on the historical evolution feature vector and the time-aware state transition relationship.

[0187] The trend prediction module is responsible for trend prediction in the long-term prediction layer. Based on the historical evolution feature vectors generated by the sequence encoding module and the time-aware state transition relationship, it predicts the probability of occurrence of each possible behavior hyperedge within the second preset time period in the future.

[0188] When making predictions, the trend prediction module uses machine learning or statistical methods, combining information from historical evolution feature vectors and state transition relationships. For example, a probability-based model can be used to predict the probability of each behavioral hyperedge appearing in the future based on historical circumstances and the likelihood of state transitions. On e-commerce platforms, the trend prediction module uses historical evolution feature vectors and time-aware state transition relationships to predict the probability of behavioral hyperedges connecting different nodes within a second preset time period.

[0189] Step S464: Filter out the top N behavior hyperedges with the highest probability according to the occurrence probability and determine them as the main evolution direction, N>0.

[0190] The main evolution direction is the direction in which the associated risk path is most likely to develop in the second preset time period in the future. By screening the top N behavioral hyperedges with the highest probability based on the probability of occurrence, the main evolution direction of the risk can be determined.

[0191] During the screening process, the occurrence probabilities of each possible behavior hyperedge obtained in step S463 are sorted, and the top N behavior hyperedges with the highest probabilities are selected. In the e-commerce platform, assuming N is 3, the predicted occurrence probabilities of each behavior hyperedge are sorted, and the three behavior hyperedges with the highest probabilities are selected as the main evolution directions.

[0192] Step S465: Calculate the average appearance interval of the behavior hyperedge corresponding to the main evolution direction in the second preset time period in the future as the evolution rate.

[0193] The evolution rate reflects the speed at which the associated risk path develops along the main evolution direction within the second preset time period in the future. The evolution rate can be obtained by calculating the average occurrence interval of the behavioral hyperedge corresponding to the main evolution direction within this time period.

[0194] When calculating the average occurrence interval, the occurrence intervals of behavioral hyperedges corresponding to the main evolutionary directions are counted and averaged based on the predicted occurrence times of each behavioral hyperedge as predicted by the trend prediction module. On the e-commerce platform, for behavioral hyperedges corresponding to the identified main evolutionary directions, the average occurrence interval is calculated based on the predicted occurrence times and used as the evolution rate.

[0195] Step S466: Combine the main evolution directions and evolution rates into a multidimensional vector, where the dimensions of the multidimensional vector correspond to the number of main evolution directions and the vector element values ​​correspond to the evolution rates, to generate a long-term evolution trend vector.

[0196] The long-term evolution trend vector comprehensively represents the evolution direction and rate of the associated risk path over a second preset time period. By combining the main evolution direction and rate into a multidimensional vector, the long-term evolution of the risk can be intuitively displayed.

[0197] When combining vectors, the dimensionality of the multidimensional vector is determined by the number of major evolutionary directions, and the evolution rate corresponding to each major evolutionary direction is used as the element value of the vector. In the e-commerce platform, assuming there are three major evolutionary directions, the evolutionary rates corresponding to these three major evolutionary directions are combined into a three-dimensional vector to serve as the long-term evolutionary trend vector.

[0198] Step S470: Integrate the short-term diffusion probability and the long-term evolution trend vector to generate a risk evolution path prediction result including the path identifier, the short-term diffusion probability and the long-term evolution trend vector.

[0199] The risk evolution path prediction results are derived by combining the short-term diffusion probability and the long-term evolution trend vector. They are used to comprehensively describe the evolution of associated risk paths at different time scales. Path identifiers are used to uniquely identify each associated risk path.

[0200] During integration, the path identifier, short-term diffusion probability, and long-term evolution trend vector of each associated risk path are combined. Within an e-commerce platform, for each associated risk path, the path identifier, calculated short-term diffusion probability, and generated long-term evolution trend vector are integrated to form a risk evolution path prediction result. For example, the path identifier of an associated risk path is a set number, the short-term diffusion probability is a certain probability value, and the long-term evolution trend vector is a multidimensional vector. These are combined into a complete result to guide the e-commerce platform's cybersecurity prevention measures.

[0201] As an implementation method, the method provided in an embodiment of the present invention further includes the step of generating a dynamic security protection scheme including node protection priority, path blocking strategy, and interface access control rules based on the short-term diffusion probability and long-term evolution trend vector in the risk evolution path prediction result. Specifically, the method can be implemented as the following steps S500-S900: Step S500: extracting the short-term diffusion probability and long-term evolution trend vector of each associated risk path from the risk evolution path prediction result.

[0202] The risk evolution path prediction results contain important information about each associated risk path. The short-term diffusion probability reflects the possibility of risk diffusion in the short term, and the long-term evolution trend vector describes the evolution direction and rate of risk in the long term.

[0203] When extracting information, the risk evolution path prediction results are analyzed in detail. For each associated risk path, the corresponding short-term diffusion probability and long-term evolution trend vector are extracted. On the e-commerce platform, the short-term diffusion probability (e.g., a certain probability value) and long-term evolution trend vector (e.g., a multidimensional vector) are extracted for each associated risk path from the risk evolution path prediction results.

[0204] Step S600: Sort the associated risk paths according to the magnitude of the short-term diffusion probability. The associated risk path with a larger short-term diffusion probability has a higher node protection priority.

[0205] Node protection priority refers to the order in which nodes on the associated risk path are protected. By sorting the associated risk paths according to the short-term diffusion probability, we can determine which nodes on the paths need to be protected first to reduce the possibility of risk diffusion.

[0206] During the sorting process, the short-term diffusion probabilities of all associated risk paths are collected, compared, and ranked. Nodes corresponding to associated risk paths with greater short-term diffusion probabilities are given higher priority for protection. Within the e-commerce platform, the short-term diffusion probabilities of each associated risk path are ranked, and protection measures are prioritized for nodes on associated risk paths with higher short-term diffusion probabilities, such as those connecting user interface nodes and storage nodes.

[0207] As an implementation manner, step S600 may be specifically implemented as the following steps S610-S660: Step S610: Collect the short-term diffusion probabilities of all associated risk paths and create a short-term diffusion probability list.

[0208] The short-term diffusion probability list is a list containing the short-term diffusion probabilities of all associated risk paths, which is used for subsequent sorting and analysis.

[0209] When collecting short-term diffusion probabilities, the short-term diffusion probabilities of each associated risk path are collated and recorded from the information extracted in step S500 to form a list. On the e-commerce platform, the short-term diffusion probabilities of each associated risk path are recorded sequentially to create a short-term diffusion probability list.

[0210] Step S620: sorting the short-term diffusion probability list in descending order to obtain a sorted associated risk path sequence.

[0211] Descending sorting is to arrange the probability values ​​in the short-term diffusion probability list from large to small. The sorted associated risk path sequence reflects the order of each associated risk path according to the size of the short-term diffusion probability.

[0212] When sorting in descending order, a sorting algorithm is used to process the short-term diffusion probability list. For example, a quick sort algorithm can be used. On an e-commerce platform, the short-term diffusion probability list is sorted in descending order to obtain a sorted sequence of associated risk paths, with paths with higher short-term diffusion probabilities placed first.

[0213] Step S630: extracting the entity nodes contained in each associated risk path in the sorted associated risk path sequence, and recording the node type and position in the path.

[0214] Entity nodes are key elements on the associated risk path. Recording the node type and position in the path helps determine the importance and protection needs of the node.

[0215] When extracting entity node information, for each path in the sorted sequence of associated risk paths, analyze the entity nodes it contains and determine the node type (e.g., communication node, storage node, interface node) and its position in the path (e.g., starting node, intermediate node, end node). Within e-commerce platforms, for each sorted associated risk path, extract the entity nodes it contains, such as user interface nodes, storage nodes, server nodes, etc., and record their type and position in the path.

[0216] Step S640: For the associated risk paths including the same entity node, the highest short-term diffusion probability is taken as the comprehensive risk probability of the entity node.

[0217] The comprehensive risk probability is an indicator used to assess the risk level faced by an entity node. For associated risk paths involving the same entity node, taking the highest short-term diffusion probability can more accurately reflect the risk level of the node.

[0218] To determine the comprehensive risk probability, the sorted sequence of associated risk paths is traversed to identify paths containing the same entity node. Their short-term diffusion probabilities are compared, and the maximum value is taken as the comprehensive risk probability for that entity node. On e-commerce platforms, if multiple associated risk paths contain the same storage node, the short-term diffusion probabilities of these paths are compared, and the maximum value is taken as the comprehensive risk probability for that storage node.

[0219] Step S650: Sort the entity nodes according to the size of the comprehensive risk probability. The entity node with a greater comprehensive risk probability has a higher protection priority.

[0220] Sorting entity nodes based on their comprehensive risk probability can determine their protection priority. Entity nodes with greater comprehensive risk probabilities face higher risks and require priority protection.

[0221] During sorting, the comprehensive risk probabilities of all entity nodes are compared and ranked. A sorting algorithm is used to rank the entity nodes from highest to lowest comprehensive risk probability. Within an e-commerce platform, the comprehensive risk probabilities of each entity node are ranked, and those with higher comprehensive risk probabilities, such as important server nodes, are given higher protection priority.

[0222] Step S660: Assign a priority level to each physical node, and generate a node protection priority list including node identification, node type and protection priority level.

[0223] The node protection priority list is a list that records the protection priority information of each entity node, which facilitates the subsequent formulation of protection plans.

[0224] When assigning priority levels, the entity nodes are divided into different priority levels based on the results of the sorting in step S650. For example, they can be divided into three levels: high, medium, and low. Each entity node is assigned a corresponding priority level, and its node identifier, node type, and protection priority level are recorded. In the e-commerce platform, each entity node is assigned a priority level and a node protection priority list is generated. For example, if the node identifier is a user interface node with a set number, the node type is an interface node, and the protection priority level is high.

[0225] Step S700: Based on the main evolution direction in the long-term evolution trend vector, determine the key behavior hyperedges that need to be blocked and generate a path blocking strategy. The path blocking strategy includes the behavior hyperedge identifiers that need to be blocked and the blocking execution time points.

[0226] Key behavior hyperedges are hyperedges that play a key role in risk propagation within an associated risk path. By identifying key behavior hyperedges that need to be blocked, further risk spread can be effectively prevented. A path blocking strategy is designed to block risk propagation and includes the identification of the behavior hyperedges to be blocked and the timing of the blockade.

[0227] When determining key behavioral hyperedges, analyze the main evolutionary directions in the long-term evolutionary trend vector and identify behavioral hyperedges related to the main evolutionary directions. Based on the importance of these behavioral hyperedges and their impact on risk propagation, determine the key behavioral hyperedges that need to be blocked. At the same time, based on the temporal sequence constraint relationship in the timing constraint set, calculate the expected occurrence time of the key behavioral hyperedges to be blocked as the blocking execution time point. In the e-commerce platform, determine the main evolutionary direction based on the long-term evolutionary trend vector, and identify the related behavioral hyperedges connecting important nodes, such as the hyperedges connecting storage nodes and server nodes, and identify them as key behavioral hyperedges. Calculate the expected occurrence time of the hyperedge based on the timing constraint set as the blocking execution time point to generate a path blocking strategy.

[0228] As an implementation manner, step S700 may be specifically implemented as the following steps S710-S750: Step S710: Analyze the main evolution direction in the long-term evolution trend vector to determine the behavior hyperedge sequence that may appear in the second preset time period in the future.

[0229] The main evolution direction reflects the main development direction of the associated risk path in the second preset time period in the future. By analyzing the main evolution direction in the long-term evolution trend vector, the possible behavioral hyperedge sequence can be determined.

[0230] During parsing, the long-term evolution trend vector is analyzed, and based on the elements in the vector and the corresponding behavioral hyperedge information, a behavioral hyperedge sequence that is likely to appear in the second preset time period is determined. On e-commerce platforms, the long-term evolution trend vector is parsed, and based on the main evolutionary direction represented by the vector, a behavioral hyperedge sequence connecting different nodes that is likely to appear in the future is determined, such as a behavioral hyperedge sequence from a user interface node to a storage node and then to a server node.

[0231] Step S720: Compare the possible behavior hyperedge sequences with the behavior hyperedge set in the dynamic risk association hypergraph, and identify the behavior hyperedges whose weight values ​​exceed a preset weight threshold as candidate key hyperedges.

[0232] The preset weight threshold is a pre-set weight value used to screen out important behavioral hyperedges. Candidate key hyperedges are hyperedges with larger weights that are screened from possible behavioral hyperedge sequences. These hyperedges may play a key role in risk propagation.

[0233] When performing the comparison, the possible behavioral hyperedge sequence determined in step S710 is compared one by one with the behavioral hyperedge set in the dynamic risk association hypergraph. For each behavioral hyperedge, check whether its weight value exceeds the preset weight threshold. If it exceeds, it is used as a candidate key hyperedge. In the e-commerce platform, the possible behavioral hyperedge sequence is compared with the behavioral hyperedge set in the dynamic risk association hypergraph, and the hyperedges with weight values ​​exceeding the preset weight threshold, such as the hyperedges connecting important server nodes, are used as candidate key hyperedges.

[0234] Step S730: Analyze the positions of candidate key hyperedges in the associated risk path, and determine candidate key hyperedges located at the beginning or middle segment of the path as key behavior hyperedges that need to be blocked.

[0235] Critical behavior hyperedges that need to be blocked are hyperedges that are ultimately determined to need to be blocked to prevent risk propagation. Candidate critical hyperedges located at the beginning or middle of a path have a greater impact on risk propagation and are therefore identified as such.

[0236] When analyzing location, for each candidate critical hyperedge, its position within the associated risk path is determined. Based on the path structure and the characteristics of risk propagation, it is determined whether it is located at the beginning or middle segment. On e-commerce platforms, candidate critical hyperedges are analyzed for their position within the associated risk path. Hyperedges located at the beginning of the path, connecting user interface nodes and storage nodes, or at the middle segment, connecting storage nodes and server nodes, are identified as critical behavior hyperedges requiring blocking.

[0237] Step S740: Calculate the expected occurrence time point of the key behavior hyperedge to be blocked according to the time sequence constraint relationship in the timing constraint set, and use it as the blocking execution time point.

[0238] The blocking execution time point is the time point at which the critical behavior hyperedge blocking operation is performed. According to the time sequence constraint relationship in the timing constraint set, the expected occurrence time point of the critical behavior hyperedge to be blocked can be accurately calculated.

[0239] When calculating the time point, the occurrence time information of the key behavior hyperedge to be blocked is searched in the timing constraint set. Based on the temporal order constraints, the expected occurrence time point is determined. On e-commerce platforms, for the key behavior hyperedge to be blocked, information such as its occurrence timestamp is obtained from the timing constraint set. The expected occurrence time point is calculated and used as the blocking execution time point.

[0240] Step S750: Combine the key behavior hyperedge identifier to be blocked and the corresponding blocking execution time point to generate a path blocking strategy. The path blocking strategy also includes a blocking method description, which is to interrupt the hyperedge connection or reduce the hyperedge weight.

[0241] A path blocking strategy is a strategy that includes the hyperedge identifier of the key behavior to be blocked, the blocking execution time point, and the blocking method description, and is used to guide network security protection operations.

[0242] When generating a path blocking strategy, the identifier of the key hyperedge to be blocked is combined with the corresponding blocking execution time. A blocking method description is also determined, such as interrupting the hyperedge connection or reducing the hyperedge weight. On e-commerce platforms, the identifier (e.g., number) of the key hyperedge to be blocked and the blocking execution time (e.g., specific time) are combined to select an appropriate blocking method, such as interrupting the hyperedge connection, to generate a path blocking strategy.

[0243] Step S800: extract the interface nodes involved in the associated risk path, set the interface access frequency threshold according to the evolution rate in the long-term evolution trend vector, and generate interface access control rules. The interface access control rules include interface identification, access frequency threshold and violation handling method.

[0244] Interface access control rules are used to control interface access. By setting access frequency thresholds, you can prevent excessive interface access and reduce risks.

[0245] When generating rules, first extract the interface nodes involved from the associated risk path. Then, determine the access frequency threshold for each interface node based on the evolution rate in the long-term evolution trend vector. A faster evolution rate indicates a faster risk propagation, requiring a lower access frequency threshold. For each interface node, record its interface identifier, access frequency threshold, and violation handling method, such as access restrictions and warnings. On e-commerce platforms, extract the user interface nodes involved from the associated risk path, set an access frequency threshold for each interface node based on the evolution rate in the long-term evolution trend vector, and generate interface access control rules.

[0246] Step S900: Integrate the node protection priority, path blocking strategy and interface access control rules into a solution to generate a dynamic security protection solution including the solution effective time, execution subject and verification indicators.

[0247] The dynamic security protection solution is a comprehensive network security protection solution that includes measures such as node protection, path blocking, and interface access control.

[0248] When integrating the solutions, the node protection priority list generated in step S660, the path blocking strategy generated in step S750, and the interface access control rules generated in step S800 are combined. Determine the effective time of the solution, such as from a specific time. Identify the execution subject, such as the network security team or security equipment. Establish verification indicators, such as the degree of reduction in the probability of risk diffusion, the improvement in node security, etc., to evaluate the effectiveness of the solution. In the e-commerce platform, the node protection priority, path blocking strategy and interface access control rules are integrated to determine the effective time of the solution, the execution subject and the verification indicators, and generate a dynamic security protection solution to ensure the network security and data security of the e-commerce platform.

[0249] It is understandable that the various algorithms involved in the above-mentioned introductions of the embodiments of the present invention can be learned from the relevant content in the prior art. In order to save space, they will not be expanded too much in the embodiments of the present invention. In addition, when implementing the scheme of the present invention, those skilled in the art can supplement the details according to the common knowledge in the field. For example, according to the common knowledge in the field, normalization can be used to eliminate dimensional conflicts before feature fusion, interpolation can be used to eliminate dimensional differences, and thresholds can be reasonably set based on historical data, experience or business scenario requirements. The model can be trained based on a general model training method, and the number of layers in the model structure can be set based on actual needs, the activation function can be selected, etc. The present invention will no longer provide redundant introductions to the overly detailed implementation process.

[0250] See also Figure 2 , Figure 2This is a schematic diagram of the structure of a computer system provided in an embodiment of the present invention. The computer system includes at least a processor 101, a communication interface 102, and a memory 103. The processor 101, communication interface 102, and memory 103 may be connected via a bus or other means. The processor 101 (also known as the Central Processing Unit (CPU)) is the computing and control core of the computer system, capable of parsing various instructions within the computer system and processing various data within the computer system. The communication interface 102 may optionally include a standard wired interface or a wireless interface (such as Wi-Fi, a mobile communication interface, etc.), which can be used to send and receive data under the control of the processor 101. The communication interface 102 may also be used for data transmission and interaction within the computer system. The memory 103 is a storage device in the computer system for storing programs and data. It is understood that the memory 103 herein may include both the built-in memory of the computer system and, of course, the extended memory supported by the computer system. The memory 103 provides storage space, which stores the computer system's operating system, but this is not limited to this in the present invention.

[0251] In one embodiment, the processor 101 executes the large model-based comprehensive analysis method for network security and data security provided in the above embodiment of the present invention by running the computer program in the memory 103.

Claims

1. A comprehensive analysis method for network security and data security based on a large model, characterized in that: include: Collect multi-source heterogeneous security data from network communication links, data storage nodes, and application interaction interfaces. The multi-source heterogeneous security data includes encrypted transmission data packet units, data access audit units, and interface call sequence units. Each data unit carries a node identifier and an interaction timestamp. Performing risk behavior atomic correlation processing on the multi-source heterogeneous security data to construct a dynamic risk correlation hypergraph; Based on the preset security domain knowledge graph, the large model is called to perform multiple rounds of risk attribution reasoning, and the attack chain fragment matching and evidence chain completion are performed on the behavioral hyperedge set in the dynamic risk association hypergraph to generate a risk attribution reasoning chain containing the main cause risk node, associated risk path and evidence confidence. According to the temporal constraint set of the risk attribution reasoning chain and the dynamic risk association hypergraph, a risk evolution probability model is constructed, and based on this, the short-term diffusion probability and long-term evolution trend vector of each associated risk path are calculated to obtain the risk evolution path prediction result.

2. The method according to claim 1, characterized in that The step of performing risk behavior atomic association processing on the multi-source heterogeneous security data to construct a dynamic risk association hypergraph includes: Performing protocol reverse analysis on encrypted transmission data packet units in the multi-source heterogeneous security data to generate atomic features of communication behavior; Decomposing the data access audit unit in the multi-source heterogeneous security data into an operation sequence to generate atomic features of access behavior; Perform call chain tracing on the interface call sequence units in the multi-source heterogeneous security data to generate interface behavior atomic features; Mapping the communication behavior atomic features, access behavior atomic features, and interface behavior atomic features into a set of entity nodes of a dynamic risk association hypergraph, wherein the communication behavior atomic features are mapped into communication nodes, the access behavior atomic features are mapped into storage nodes, and the interface behavior atomic features are mapped into interface nodes; Based on the interaction timestamps, the co-occurrence frequency and temporal dependency of the behavioral atomic features between different entity nodes are calculated, and a behavioral hyperedge set connecting multiple entity nodes is constructed. Generate a timing constraint set based on the interactive time stamps of multi-source heterogeneous security data, wherein the timing constraint set is used to limit the occurrence time sequence of each hyperedge in the behavior hyperedge set; The entity node set, behavior hyperedge set and time sequence constraint set are integrated into a hypergraph structure to generate a dynamic risk association hypergraph containing node attributes, hyperedge weights and time sequence constraints.

3. The method according to claim 2, characterized in that The method of calculating the co-occurrence frequency and temporal dependency of the behavior atomic features between different entity nodes based on the interaction timestamps and constructing a behavior hyperedge set connecting multiple entity nodes includes: Extract the interaction time stamp sequence of communication nodes, storage nodes and interface nodes to determine the occurrence time point of the atomic feature of each node behavior; The time stamp sequence is segmented by time interval division. The number of combinations of communication node behavior atomic features, storage node behavior atomic features, and interface node behavior atomic features that appear simultaneously in each time interval is counted to obtain the co-occurrence frequency. Mark the behavior atomic feature combinations in each time interval in temporal order, and calculate the conditional probability of the preceding behavior atomic feature and the subsequent behavior atomic feature as the temporal dependency; The co-occurrence frequency is converted into a co-occurrence weight of a preset numerical interval by using the maximum value normalization method, and the temporal dependency is converted into a dependency weight of a preset numerical interval by using the maximum value normalization method; Performing a weighted summation of the co-occurrence weight and the dependency weight according to a preset ratio to obtain a comprehensive weight of the behavior hyperedge; According to the type and number of entity nodes in the behavioral atomic feature combination, a hyperedge structure containing more than two entity nodes is constructed, and the comprehensive weight is assigned to the hyperedge structure to generate a behavioral hyperedge set.

4. The method according to claim 2, characterized in that Generating a timing constraint set based on interactive timing stamps of multi-source heterogeneous security data includes: Extract the occurrence timestamps of all behavioral hyperedges in the dynamic risk association hypergraph, establish a hyperedge timestamp sequence, and sort the hyperedge timestamp sequence in ascending order to determine the time sequence of each behavioral hyperedge; For any two behavior hyperedges that share a shared entity node, if the occurrence timestamp of the preceding behavior hyperedge is earlier than the occurrence timestamp of the subsequent behavior hyperedge, a time precedence constraint relationship is generated; For behavioral hyperedges containing the same set of entity nodes, the time interval between their occurrence timestamps is calculated. If the time interval is less than the preset minimum interval threshold, a time overlap constraint relationship is generated. All generated time sequence constraint relations and time overlap constraint relations are structuredly encoded to generate a temporal constraint set including hyperedge identification pairs and constraint types.

5. The method according to claim 1, wherein Based on the preset security domain knowledge graph, the large model is called to perform multiple rounds of risk attribution reasoning, and the attack chain fragment matching and evidence chain completion are performed on the behavior hyperedge set in the dynamic risk association hypergraph to generate a risk attribution reasoning chain containing the main cause risk node, associated risk path and evidence confidence, including: Extract attack pattern descriptions, vulnerability feature descriptions, and defense rule descriptions from the preset security domain knowledge graph, and convert the attack pattern descriptions into structured behavioral feature templates; Convert the entity node set, behavior hyperedge set, and temporal constraint set of the dynamic risk association hypergraph into a graph structure text description that can be parsed by the large model as the input context for the first round of reasoning; The large model is called and combined with the behavioral feature template to perform the first round of reasoning on the graph structure text description, identifying the candidate attack chain fragments in the behavioral hyperedge set that match the attack pattern description, and outputting the entity node sequence and behavioral hyperedge sequence contained in the candidate attack chain fragments; The candidate attack chain fragments output by the first round of reasoning are used as the input of the second round of reasoning. The large model is called to match the vulnerability characteristics of the entity nodes in the candidate attack chain fragments with the vulnerability feature description, and the entity nodes with vulnerability characteristics are identified as potential risk nodes. The potential risk nodes and the corresponding candidate attack chain fragments are used as inputs for the third round of reasoning. The large model is used in conjunction with the defense rule description to perform an abnormality assessment on the behavioral hyperedges of the potential risk nodes, generating an abnormality assessment result. Potential risk nodes with high risk as a result of the abnormality assessment are marked as the main risk nodes. Based on the main risk node, the behavioral hyperedge connection path in the dynamic risk association hypergraph is traced back to generate the associated risk path including the main risk node, associated entity node and behavioral hyperedge sequence; Calculate the product of the weight value of each behavior hyperedge in the associated risk path and the abnormality assessment result as the evidence confidence of each link in the path; The main risk nodes, associated risk paths and the confidence of evidence in each link are integrated in the order of reasoning to generate a risk attribution reasoning chain.

6. The method according to claim 5, characterized in that The conversion of the attack pattern description into a structured behavioral feature template includes: Parsing the text content of the attack pattern description to extract the key behavioral stages in the attack process, wherein the key behavioral stages are a sequence of behaviors arranged in chronological order; Match the corresponding entity node type for each key behavior stage, where the initial stage corresponds to the communication node, the intermediate stage corresponds to the interface node, and the subsequent stage corresponds to the storage node; Extract the core behavioral features of each key behavior stage. The core behavioral features of the initial stage are unauthorized port connection attempts, the core behavioral features of the middle stage are abnormal parameter construction calls, and the core behavioral features of the subsequent stages are permission boundary violations. The key behavior stages, entity node types and core behavior features are combined into a structured behavior feature template, which includes a stage placeholder area, a node type placeholder area and a behavior feature placeholder area.

7. The method according to claim 5, characterized in that The calling of the large model combines the vulnerability feature description to match the vulnerability features of the entity nodes in the candidate attack chain fragments, and determines the entity nodes with vulnerability features as potential risk nodes, including: Extract vulnerability-related information from the vulnerability feature description. Each vulnerability-related information includes the affected node type, triggering behavior description, and damage degree description. Identify the types of entity nodes in the candidate attack chain fragments and determine the node type of each entity node, where the node types include communication nodes, storage nodes, and interface nodes. According to the node type of the entity node, the vulnerability-related information matching the type is filtered out from the vulnerability feature description to obtain a node type matching vulnerability information set; Extract the behavioral atomic features of the entity nodes in the candidate attack chain fragments, match the behavioral atomic features with the node type, and calculate the semantic similarity of the triggering behavior description of each vulnerability-related information in the vulnerability information set to obtain the behavioral matching results; The entity nodes corresponding to the vulnerability-related information with highly similar behavior matching results are marked as entity nodes with vulnerability characteristics, and the vulnerability-related information and hazard level description of the entity nodes are recorded to generate a list of potential risk nodes.

8. The method according to claim 5, characterized in that The method of tracing the behavior hyperedge connection path in the dynamic risk association hypergraph based on the main cause risk node to generate an associated risk path including the main cause risk node, associated entity node and behavior hyperedge sequence includes: Taking the main cause risk node as the starting retrieval point, the behavior hyperedge directly connected to the starting retrieval point is retrieved in the dynamic risk association hypergraph to obtain the first-level association hyperedge; For each first-level associated hyperedge, extract the other entity nodes connected by the hyperedge as first-level associated nodes, and record the weight value of the first-level associated hyperedge and the corresponding timing constraint relationship; Using the first-level association node as the new starting point, repeat the above search process until the boundary node of the dynamic risk association hypergraph is retrieved or the preset search depth limit is reached, and multi-level association hyperedges and multi-level association nodes are obtained; According to the time sequence constraint relationship in the temporal constraint set, the multi-level associated hyperedges are sorted in time order to generate a behavior hyperedge sequence arranged in time order; The main cause risk nodes and multi-level associated nodes are arranged according to the connection relationship of the behavioral hyperedge sequence to generate an associated risk path containing the node order and the corresponding behavioral hyperedge sequence.

9. The method according to claim 1, characterized in that The risk evolution probability model is constructed based on the risk attribution reasoning chain and the temporal constraint set of the dynamic risk association hypergraph. Based on this model, the short-term diffusion probability and long-term evolution trend vector of each associated risk path are calculated to obtain the risk evolution path prediction results, including: Extract the associated risk paths and the evidence confidence of each link from the risk attribution reasoning chain, and extract the temporal constraint relationship corresponding to the associated risk paths from the temporal constraint set of the dynamic risk association hypergraph; Based on the behavior hyperedge sequence and evidence confidence in the associated risk path, a path state transition relationship is constructed. The path state transition relationship represents the probability value of transitioning from one behavior hyperedge to the next behavior hyperedge, which is determined by the product of the evidence confidence of the current behavior hyperedge and the hyperedge weight; Combined with the time interval information in the timing constraint relationship, the path state transition relationship is time-attenuated and adjusted to generate a time-aware state transition relationship. Constructing a risk evolution probability model based on a time-aware state transition relationship, wherein the risk evolution probability model includes a short-term prediction layer and a long-term prediction layer. The short-term prediction layer is used to predict the risk diffusion within a first preset time period in the future, and the long-term prediction layer is used to predict the risk evolution within a second preset time period in the future; Calculate the diffusion probability value of each associated risk path in the first preset time period in the future through the short-term prediction layer as the short-term diffusion probability; The long-term prediction layer calculates the evolution direction and rate of each associated risk path in the second preset time period in the future as the long-term evolution trend vector; Integrate the short-term diffusion probability and long-term evolution trend vector to generate the risk evolution path prediction results including path identification, short-term diffusion probability and long-term evolution trend vector.

10. A computer system, characterized in that: include: a memory storing a computer program; A processor, configured to load the computer program to implement the large model-based comprehensive analysis method for network security and data security as described in any one of claims 1 to 9.

Images