Computer network security threat real-time monitoring method and system

Abstract

The invention discloses a computer network security threat real-time monitoring method and system, and relates to the technical field of network security, and the method comprises the steps: collecting and preprocessing multi-source network data, organizing the multi-source network data into a behavior sequence according to a time sequence, and forming time sequence behavior data for analysis; constructing an attack atlas based on the preprocessed multi-source network data, and in the atlas construction process, forming dynamic representation of the attack atlas in combination with time attributes of behavior events and inter-entity contexts; time sequence behavior data are input into an RCLNet architecture for analysis, the RCLNet extracts spatial features through CNN, the LSTM captures time features, key behavior features are concerned by using an adaptive attention mechanism, and a high-dimensional behavior embedding vector is generated. High-precision and real-time detection and response to network threats are realized, and the intelligence and actual combat adaptability of the system are greatly improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a computer network security threat real-time monitoring method and system. BACKGROUND

[0002] With the rapid development of information technology and intelligent devices, computer networks are becoming increasingly complex, and network attack methods are constantly evolving, showing characteristics such as high concealment, distribution, and strong persistence, which pose serious challenges to traditional network security protection mechanisms. Especially in the Internet of Things (IoT) and Internet of Medical Things (IoMT) environments, the devices are highly heterogeneous, the protocols are complex, and the resources are limited, making it difficult for traditional intrusion detection systems (IDS) based on feature matching and static rules to effectively identify new, variant, or low-frequency attack behaviors. In recent years, researchers have begun to introduce advanced methods such as deep learning, graph neural networks (GNN), and behavior modeling to model and analyze network traffic, user behavior, and system logs to uncover potential threats. Attack graphs, as a knowledge representation form that expresses attack paths, attacker behaviors, and their contextual associations in a graph structure, have become an important tool for network threat analysis and tracing. However, current mainstream attack graph construction schemes are mostly based on static data or post-audit logs to construct graphs, lacking real-time modeling capabilities for network behavior, and unable to dynamically reflect the evolution process of attack activities, limiting the play of their real-time defense capabilities.

[0003] Existing network threat monitoring technologies still have obvious deficiencies in several key aspects. First, at the data processing level, most methods cannot effectively integrate heterogeneous information from different data sources (such as IoMT devices, host systems, user behavior, etc.), limiting the scope of threat perception. Second, in terms of behavior modeling, existing methods mostly focus on one dimension of time series or spatial relationships, ignoring the complex temporal and spatial dependencies between behaviors, which affects the recognition accuracy of attack chain stage evolution. In addition, the static modeling approach of attack graphs cannot capture the changing characteristics of entity interaction behaviors over time, lacking the ability to capture dynamic contextual relationships on the attack chain. Further, current anomaly detection models mostly only make coarse-grained judgments on whether a behavior is abnormal, lacking the ability to further locate abnormal behaviors, annotate graphs, and identify attack stages, resulting in a lag in the response link and affecting the timeliness of security disposal. Therefore, there is an urgent need for a real-time threat monitoring system that can dynamically model attack processes from multiple data sources, with time series analysis and graph reasoning capabilities, to achieve efficient and accurate identification and response of network threats. SUMMARY

[0004] In view of the above problems of existing computer network security threat real-time monitoring methods and systems, we propose the present application.

[0005] Therefore, the application provides a computer network security threat real-time monitoring method and system, which solves the problems of weak multi-source data fusion capability, insufficient attack behavior dynamic modeling, imperfect attack graph real-time updating and lack of automatic support in threat response link in the existing network security threat monitoring technology.

[0006] To solve the above technical problems, the application provides the following technical solutions.

[0007] In a first aspect, the application provides a computer network security threat real-time monitoring method, which comprises,

[0008] Collecting multi-source network data and preprocessing, organizing the multi-source network data into behavior sequences in chronological order to form time-series behavior data for analysis, constructing an attack graph based on the preprocessed multi-source network data, and forming a dynamic representation of the attack graph by combining the time attributes of behavior events and the context between entities during graph construction.

[0009] Inputting the time-series behavior data into the RCLNet architecture for analysis, RCLNet extracting spatial features through CNN, LSTM capturing temporal characteristics, and using an adaptive attention mechanism to focus on key behavior features to generate high-dimensional behavior embedding vectors, classifying the behavior embedding vectors as normal or abnormal, labeling the detected abnormal behavior to the attack graph nodes or edges, and dynamically updating the attack graph.

[0010] Based on the attack graph, attack stage identification is performed through a graph neural network, the location of abnormal behavior in the attack chain is located, and threat response operations are performed.

[0011] As a preferred scheme of the computer network security threat real-time monitoring method, wherein: the RCLNet extracts spatial features through CNN, LSTM captures temporal characteristics, and uses an adaptive attention mechanism to focus on key behavior features to generate high-dimensional behavior embedding vectors, including:

[0012] Three convolution kernel sizes are used to perform convolution operations on the input time-series behavior data, different scale behavior features are extracted, different scale behavior features are spliced in the feature dimension to obtain a feature matrix with comprehensive multi-scale information, and the multi-scale feature matrix is post-processed and enhanced to obtain an enhanced multi-scale feature matrix F.

[0013] The feature matrix F is input into the first layer of the one-dimensional convolution, the convolution kernel size and the inflation rate are set, the input features in the feature matrix F are added to the convolution result using a residual connection, and ReLU activation is performed to obtain the residual enhanced output of the first layer and continue to enter the second layer of the hollow convolution, the output of the current layer is added to the output of the first layer after convolution and residual connection, and finally the feature matrix E is obtained.

[0014] The features in the feature matrix F are up-sampled using a transpose convolution, the number of time steps in the feature matrix F and the feature matrix E are unified, the aligned feature matrix F and the feature matrix E are fused in the channel dimension to obtain a new feature matrix G;

[0015] The feature matrix G is globally averaged pooled, each channel is averaged along the time dimension to obtain a channel description vector s, two fully connected networks are used to compress and restore the vector s, a channel weight vector β is generated through a Sigmoid activation function, the channel weight β is applied to the feature matrix G, and the feature matrix G' is obtained after channel weighting;

[0016] The feature matrix G' is further subjected to a spatial attention mechanism, including maximum pooling and average pooling along the channel dimension of G', two single-channel feature maps are obtained, the two single-channel feature maps are spliced according to the time steps to form a two-dimensional tensor M, which is input into a one-dimensional convolution layer with a convolution kernel size of k to generate a spatial attention map γ, and the spatial attention map γ is applied to each time step of the feature matrix G' to obtain a final enhanced feature matrix D;

[0017] The feature matrix D is globally averaged pooled to obtain a two-dimensional tensor containing all time step features;

[0018] The two-dimensional tensor is input into an LSTM network to obtain a hidden state sequence, i.e., a time series feature tensor;

[0019] The obtained time series feature tensor is position enhanced, and three different linear transformations are applied to the enhanced time series feature tensor to generate query vectors, key vectors and value vectors. The query, key and value vectors are divided into multiple sub-heads, each sub-head independently models the attention relationship in a low-dimensional subspace. The key vector is mapped to a lower-dimensional space through an additional linear transformation and normalized to obtain a normalized low-dimensional key vector tensor, and a clustering operation is performed on the unit sphere to select the key vectors most relevant to the query vectors as a candidate key vector set. Attention calculation is performed on each query vector in the candidate key vector set. The output of each attention head is mapped back to the original feature dimension through a linear transformation, and the transformed vector is residual connected with the enhanced time series feature tensor and subjected to layer normalization to obtain fused time series features. Further, a global behavior vector representing the entire sequence is obtained, and a weighted pooling method is used to aggregate the features in the time dimension to obtain a high-dimensional behavior embedding vector.

[0020] As a preferred scheme of the computer network security threat real-time monitoring method, wherein: the behavior embedding vector is classified as normal or abnormal, the detected abnormal behavior is labeled into the attack graph node or edge, and the attack graph is dynamically updated by using a multi-layer perception as a classification model, inputting the behavior embedding vector into the classification model, outputting a normal or abnormal label, and simultaneously generating an abnormal confidence score and abnormal type information, and according to the classification result, the abnormal behavior is positioned and labeled, and the attack graph is globally and dynamically updated.

[0021] As a preferred scheme of the computer network security threat real-time monitoring method, wherein: the attack stage identification based on the attack graph and the graph neural network, and the positioning of the position of the abnormal behavior in the attack chain refer to dividing the attack graph into continuous time sequence snapshots according to a preset time window, and encoding the structural features, attribute features and abnormal confidence of the nodes and edges to form a feature vector sequence.

[0022] The feature vector sequence is input into a time sequence graph neural network model, the model uses an attention mechanism combined with a time decay factor to aggregate the features of adjacent nodes for each node and extract a time sequence evolution pattern, and outputs a stage classification result of the node in the attack chain and a probability distribution thereof, and writes the stage classification result back to the corresponding node attribute, so as to realize accurate positioning of the position of the abnormal behavior in the attack chain.

[0023] As a preferred scheme of the computer network security threat real-time monitoring method, wherein: the execution of the threat response operation refers to matching a corresponding disposal scheme according to a predefined security policy library.

[0024] As a preferred scheme of the computer network security threat real-time monitoring method, wherein: the collection of the multi-source network data refers to collecting IoMT device data, network flow data, user behavior data and host system data, and encapsulating them into structured JSON objects through a unified data format.

[0025] As a preferred scheme of the computer network security threat real-time monitoring method, wherein: the attack graph is constructed based on the preprocessed multi-source network data, and in the graph construction process, the dynamic representation of the attack graph is formed by combining the time attribute of the behavior event and the context between entities, which includes:

[0026] All unique entities participating in the behavior are extracted from all the behavior data, and are uniformly numbered or classified as nodes in the graph, directed edges are established between the entities according to the interaction actions recorded in the behavior data, the frequency of frequently occurring behavior relationships in all data is counted as the initial weight of the edges;

[0027] Access the latest behavior data stream with a fixed time window and update the attack graph in real time.

[0028] In a second aspect, the present application provides a computer network security threat real-time monitoring system, comprising,

[0029] A data acquisition module is configured to acquire multi-source network data and perform unified preprocessing, and convert the data into a structured JSON format.

[0030] An attack graph construction module is configured to construct an attack graph based on time-series behavior data, and dynamically update the graph structure according to the time attribute of the behavior event and the context information between entities.

[0031] A behavior analysis module is configured to extract spatial and temporal features in the time-series behavior data through an RCLNet architecture, and generate high-dimensional behavior embedding vectors.

[0032] An anomaly detection module is configured to input the generated behavior embedding vectors into a classification model, identify abnormal behaviors, and label the behaviors to nodes or edges of the attack graph, and update the graph in real time.

[0033] A threat response module is configured to analyze the attack graph through a graph neural network, identify the position of abnormal behaviors in the attack chain, and perform corresponding threat response operations.

[0034] In a third aspect, the present application provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, any step of the computer network security threat real-time monitoring method according to the first aspect of the present application is implemented.

[0035] In a fourth aspect, the present application provides a computer readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, any step of the computer network security threat real-time monitoring method according to the first aspect of the present application is implemented.

[0036] The present application has the following beneficial effects: by constructing a dynamic attack graph, combining time-series behavior modeling and graph neural network analysis methods, realizing the closed-loop processing of network threats from perception, analysis to response, introducing a multi-scale convolution and hollow residual structure CNN module, effectively improving the extraction ability of complex behavior characteristics, combining channel and spatial adaptive attention mechanism, enhancing the attention degree of key behaviors, and fusing LSTM and graph neural network to realize behavior sequence modeling and attack chain positioning, a dynamic evolution attack graph is constructed, realizing high-precision and real-time detection and response of network threats, and greatly improving the intelligence and practical adaptability of the system. BRIEF DESCRIPTION OF DRAWINGS

[0037] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the embodiments will be briefly introduced. Obviously, the drawings in the following description only constitute some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative effort.

[0038] Figure 1 The flowchart of the computer network security threat real-time monitoring method in embodiment 1.

[0039] Figure 2 The structural diagram of the computer network security threat real-time monitoring system in embodiment 1. DETAILED DESCRIPTION

[0040] In order to make the above-mentioned purposes, features and advantages of the present application more apparent and easy to understand, the specific embodiments of the present application will be described in detail below with reference to the drawings.

[0041] In the following description, many specific details are set forth in order to provide a thorough understanding of the present application. However, the present application can be practiced in other ways not described herein, and the skilled in the art can make similar generalizations without departing from the scope of the present application, so the present application is not limited to the specific embodiments disclosed below.

[0042] Secondly, the "one embodiment" or "embodiment" referred to herein means that the specific features, structures or characteristics can be included in at least one implementation of the present application. In this specification, "in one embodiment" appearing in different places does not mean the same embodiment, nor does it mean an embodiment that is separate or selectively excluded from other embodiments.

[0043] Embodiment 1, refer to Figure 1 and Figure 2 , the first embodiment of the present application, the embodiment provides a computer network security threat real-time monitoring method, the computer network security threat real-time monitoring method comprises the following steps:

[0044] S1, collecting multi-source network data and preprocessing, organizing the multi-source network data into behavior sequence according to time sequence, forming time sequence behavior data for analysis, constructing attack graph based on the preprocessed multi-source network data, combining the time attribute of behavior event and the context between entities in the graph construction process, forming the dynamic representation of attack graph;

[0045] Specifically, multi-source network data is collected and preprocessed, and the multi-source network data is organized into behavior sequences in chronological order to form time-series behavior data for analysis. A distributed data collection framework combining edge agents and Kafka stream processing pipelines is adopted. Lightweight collection agents are embedded in devices at the enterprise network, loMT devices, host systems, and cloud services. Behavior data, including loMT device data, network traffic data, user behavior data, and host system data, is extracted in real time using protocol adapters (such as Modbus, Syslog, sFlow, etc.). The data is packaged into structured JSON objects using a unified data format, and is transmitted to Kafka topic channels with standard timestamps and data source identifiers.

[0046] The collected data is formatted and standardized. According to the established behavior field mapping rules, the original data items are converted into a unified behavior event structure. The K-Nearest Neighbor interpolation algorithm is used to infer missing fields in the behavior context, ensuring that each behavior sample has complete information. Further time synchronization is performed using the NTP protocol, and linear interpolation is applied to calibrate data with time errors, thereby achieving time alignment across data sources. The aligned data is sorted in ascending order of event occurrence time and organized into behavior sequences in a fixed time window sliding manner to form a continuous, multi-dimensional time behavior window set. Each window encapsulates all behavior events occurring within a certain period of time.

[0047] The loMT device data includes sensor data, device status information, device control command logs, and device communication records.

[0048] IoT / edge devices are usually deployed at the network edge, with weak physical and logical protection capabilities, making them vulnerable to attackers as intrusion stepping stones or information collection portals. By collecting the running status, control commands, communication behavior, etc. of these devices, abnormal patterns such as frequent external connection, remote control request, and unauthorized access can be identified in real time, thereby achieving early threat detection and warning for edge nodes in network security protection, significantly improving the overall threat visualization capability of the system.

[0049] The network traffic data includes raw network packet summaries (source / destination IP, port, protocol, packet length, traffic, etc.), TCP connection state information, DNS query records, and HTTP session logs.

[0050] Network traffic data is a key data source for discovering external attacks (such as scanning, brute force cracking, DDoS) and internal horizontal movement. By modeling communication patterns, abnormal traffic characteristics can be captured, and potential penetration or data leakage behavior can be identified in a timely manner, making it an indispensable foundation for real-time threat monitoring.

[0051] The user behavior data includes login and identity verification records, user operation behavior records, and user session trajectories (activity timelines, window switching, jump paths, etc.);

[0052] Internal threats (such as unauthorized operations, account misuse, and credential leaks) are usually disguised as legitimate user behavior, making them difficult to detect. User behavior data can assist in establishing user behavior baselines and issuing timely alerts when behavior deviates, serving as the basis for building a "user behavior anomaly detection (UEBA)" mechanism.

[0053] The host system data includes system process information (process start time, path, PID, parent-child relationship), file system access logs, system resource usage, and system security event logs.

[0054] Host data can reveal system-level attack behaviors (such as remote code execution, malicious persistence, and shell rebound). Process chains and file operation behaviors serve as key clues to help reconstruct attack paths and trace sources. Persistent control or information theft behaviors can also be detected through process behavior graphs.

[0055] Through edge proxies and Kafka stream processing pipelines, efficient collection and transmission of multi-source heterogeneous data are achieved. Protocol adapters and field mapping are used to unify behavior semantics. K-Nearest Neighbor interpolation and time calibration are used to improve data integrity and time consistency. Behavior sequences in sliding window form are constructed to effectively preserve behavior evolution characteristics, providing high-quality, structured, and time-continuous input data for subsequent threat detection models, significantly improving the system's perception ability and real-time response efficiency for complex attack behaviors.

[0056] Further, based on the preprocessed multi-source network data, an attack graph is constructed. During the graph construction process, the time attributes of behavior events and the context between entities are combined to form a dynamic representation of the attack graph, including:

[0057] All unique entities involved in the behavior data are extracted, including hosts, user accounts, IoT / IoMT devices, sensors, servers, and service ports, and are uniformly numbered or classified as nodes in the graph.

[0058] According to the interaction actions recorded in the behavior data, such as communication, access, control, and login, directed edges are established between entities to represent the behavior connection between entities. Each edge is labeled with behavior type, communication direction, and behavior strength (such as communication frequency and traffic size), and the first occurrence and the most recent occurrence time are recorded.

[0059] The frequency of frequently occurring behavior relationships in all data is calculated as the initial weight of the edge to reflect the strength of the relationship between entities.

[0060] Both nodes and edges are attached with relevant context information, such as network area, security level, user role, device type, etc., to enhance the expression ability of the graph;

[0061] After the initial graph construction, the continuously generated time-series behavior data is accessed to drive the dynamic update and time evolution modeling of the attack graph. This mechanism ensures that the graph can reflect the changes in system behavior in real time and capture potential attack paths and risky behaviors in a timely manner.

[0062] The latest behavior data stream is accessed in a fixed time window (e.g., 5 minutes) to update the graph structure and attributes. For newly appearing entities within the window, they are automatically added as new nodes. If new interaction relationships are found, corresponding new edges are added. If it is an existing entity relationship, the edge weight is updated according to the behavior frequency within the time window through the following formula:

[0063]

[0064] where W new (A→B) is the updated edge weight, representing the "importance" or "strength" of the edge from node A to node B after updating, W old (A→B) is the original edge weight, is the latest observed frequency or strength, representing the frequency of events, interaction times, or score values observed from node A to node B, and α is the weighting factor, f recent (A, B) is the number of events, interaction frequency, or strength score from node A to node B within the last period of time, represents the total interaction from node A to all possible target nodes j in the last period of time;

[0065] All nodes and edges retain attributes such as recent activity time, behavior persistence, and change frequency to support time evolution modeling and periodic evolution analysis of the graph structure. In each update, the context information of nodes and edges (such as whether it is cross-domain communication, whether it accesses high-sensitive resources, and the security policy it belongs to) is updated synchronously to reflect the current semantic state of the entity. After dynamic updating, the real-time attack graph structure is output, which contains a complete set of entities, behavior relationships, and attached time and semantic information, forming a dynamic graph representation with time evolution ability.

[0066] The application constructs a dynamic evolution attack graph, combines multi-scale convolution and a hollow residual structure to improve behavior feature extraction capability, introduces a channel and spatial adaptive attention mechanism to enhance the model's attention to key behaviors, and improves the accuracy of anomaly detection. A fixed time window update strategy and an edge weight dynamic adjustment formula are used to make the graph reflect the interaction changes between entities in real time and accurately capture attack paths and behavior mutations. By fusing context semantic information, the current security state of the entity is perceived and expressed, the system's explainability and intelligent level are enhanced, and the real-time performance, integrity and robustness of network threat identification are significantly improved.

[0067] S2, input the time series behavior data into the RCLNet architecture for analysis, the RCLNet extracts spatial features through CNN, captures time characteristics through LSTM, and uses an adaptive attention mechanism to focus on key behavior features, generates high-dimensional behavior embedding vectors, classifies the behavior embedding vectors as normal or abnormal, labels the detected abnormal behavior to the attack graph nodes or edges, and dynamically updates the attack graph;

[0068] Specifically, the RCLNet extracts spatial features through CNN, captures time characteristics through LSTM, and uses an adaptive attention mechanism to focus on key behavior features to generate high-dimensional behavior embedding vectors, including:

[0069] Three convolution kernel sizes are used to perform convolution operations on the input time series behavior data to extract behavior features of different scales, including using 1x1 convolution to capture local features of individual behavior events and maintain the independence of each behavior. In this way, the individual semantics of each behavior can be accurately represented, 3x3 convolution is used to extract interaction patterns in adjacent time periods, such as consecutive requests from the same IP or consecutive operations from the same process, and 5x5 convolution is used to extract global behavior features (such as behavior patterns in a long time period or attack chains in a long time sequence). Through this operation, global patterns across multiple behavior units can be captured;

[0070] The behavior features of different scales are spliced in the feature dimension to obtain a feature matrix that integrates multi-scale information, containing multi-dimensional information from individual behavior, adjacent behavior to whole sequence behavior;

[0071] The post-processing and enhancement of the multi-scale feature matrix F are performed, including batch normalization processing of each column (i.e., each feature dimension) in the feature matrix, reducing the gradient vanishing or explosion problem of each layer, promoting the stability of the training process, ReLU activation processing of the normalized features, introducing a nonlinear factor to enable the model to better fit complex patterns, and after ReLU activation, the obtained feature matrix may still contain some redundant information in the time dimension. In order to further compress the feature dimension and retain the most significant features, a MaxPooling operation is introduced, which selects the maximum value in each local region (usually a small section in the time dimension) of the feature matrix, thereby reducing the dimension of the feature map while retaining key features and reducing computational complexity;

[0072] In order to prevent overfitting of the model during training, Dropout regularization is introduced on the pooled feature matrix. Dropout operation randomly discards some neuron connections, forcing the network to learn more robust feature representations, thereby improving generalization ability. The proportion (i.e., dropout ratio) of Dropout is set according to experience;

[0073] The feature matrix F is input into the first layer of dilated one-dimensional convolution, and the convolution kernel size and dilation rate are set. In this embodiment, the current dilation rate is set to 2. This operation effectively expands the receptive field by sampling adjacent behavior events at intervals on the time axis, enabling the capture of long-span time interval dependent patterns. Compared with ordinary convolution, dilated convolution does not increase the number of parameters, but can perceive a larger range of information;

[0074] The input features and the convolution results are added using residual connection to form the first layer of residual enhancement output and perform ReLU activation. The feature matrix after the first layer processing is transmitted to the second layer of residual enhancement module for further dilated convolution. In this embodiment, the current dilation rate is set to 4 to further expand the receptive field and capture longer time series dependencies. After dilated convolution, residual connection is performed to add the second layer of convolution features and the output of the first layer, thereby increasing the receptive field while retaining the feature information of the first layer. The second layer output feature matrix contains time series information extracted from a longer time range, further enhancing the model's learning ability for long-time dependencies;

[0075] After multiple layers of modeling through residual enhancement and dilated convolution, the final feature matrix contains deep time series abstract information, which reflects the long-time dependency between behavior events and can capture behavior patterns across time periods. The shape of the output feature matrix E is TxC, where T is the time dimension after dilated convolution and residual processing, and C is the feature dimension, representing the time series features extracted after multiple layers of residual enhancement and dilated convolution;

[0076] The features in the feature matrix F are up-sampled using a transpose convolution to unify the time steps in the feature matrix F and the feature matrix E. The transpose convolution expands the feature map in space to align the dimensions and preserve more detailed information while not losing global information. This operation generates a feature matrix F with the same dimension as the feature matrix E, ensuring that the features of the two paths can be fused;

[0077] The aligned feature matrix F and the feature matrix E are fused in the channel dimension through a 1*1 convolution to obtain a new feature matrix G;

[0078] The feature matrix G is globally averaged pooled, and each channel is averaged along the time dimension to obtain a channel description vector s. Two fully connected networks are used to compress and restore the features of the vector s, and a sigmoid activation function is used to generate a channel weight vector β. The channel weight β is applied to the feature matrix G to obtain a channel-enhanced feature matrix G';

[0079] To enhance the attention to the target time step (behavior key time point), a spatial attention mechanism is further applied to the feature matrix G'. The maximum pooling and average pooling are performed along the channel dimension of G' to obtain two single-channel feature maps. The two single-channel feature maps are concatenated along the time step to form a two-dimensional tensor M, which is input into a one-dimensional convolution layer with a convolution kernel size of k to generate a spatial attention map γ. The spatial attention map γ is applied to each time step of the feature matrix G' to obtain the final enhanced feature matrix D. The spatial attention map γ is broadcasted and expanded in the channel dimension to generate a weight matrix γ', which is consistent with the feature matrix G' in dimension. The expanded attention matrix γ' and the feature matrix G' are multiplied element by element to obtain a new feature matrix D;

[0080] The feature matrix D is globally averaged pooled, i.e., the features of each channel are averaged along the spatial dimension to obtain the global spatial feature representation of each frame. For each time step t, the vector extracted after global average pooling forms a sequence, and finally a two-dimensional tensor containing the features of all time steps is obtained;

[0081] The two-dimensional tensor is input into an LSTM network. Each layer of the LSTM processes the feature sequence along the time dimension, thereby learning the dependency between time steps in the sequence. The LSTM can capture long-range dependencies through its memory cell (cell state), avoiding the gradient vanishing problem in traditional RNNs, and ensuring that long-time span behavior sequences can be effectively modeled;

[0082] The feature sequence is taken as the input of the LSTM model, is input into the first layer of the LSTM network, and each feature vector in the sequence is processed time step by time step, the dynamic dependence between the current time step and the historical time step is modeled through the memory unit and the gating mechanism, so as to capture the evolution trend and the context semantic relationship of the behavior event in the time dimension, in order to enhance the expression ability of the model to the complex behavior sequence, the LSTM module adopts a multi-layer stacking structure, so that the output hidden state of each layer is taken as the input of the next layer, multi-level time dependence modeling is realized, in the whole process, the LSTM effectively avoids the gradient disappearance problem faced by the traditional recurrent neural network, can long-term maintain the memory of the remote historical state, and then identify the potential attack chain existing between the causal relationship such as "first abnormal access" and "subsequent port scanning", finally, the hidden state sequence output by the LSTM, that is, the time sequence feature tensor, has a shape of "sample number x time step number x feature dimension", which represents the dynamic behavior characteristics of the input sequence in the time dimension, and will be taken as the input of the subsequent attention mechanism or behavior classification module, for further highlighting the key time points and strengthening the judgment area, so as to realize more accurate attack identification and behavior analysis;

[0083] For input sequences of different lengths, the time dimension length is unified through padding operation, and a padding mask matrix is generated at the same time, which is used to identify which time steps are real data and which are padding data, so as to accurately process the effective time information in the subsequent steps;

[0084] The position of the obtained time sequence feature tensor is enhanced to retain the time sequence information, and the specific method is: a learnable position vector corresponding to each time step is added to the original feature vector, and the enhanced input sequence is obtained by element addition, in order to avoid overfitting, a random inactivation operation can also be applied to the sequence in the training stage, finally, the enhanced time sequence feature tensor is obtained;

[0085] Three different linear transformations are applied to the enhanced time sequence feature tensor to generate query vectors, key vectors and value vectors, each linear transformation is realized by an independent weight matrix, and the output vector dimension is consistent with the original feature dimension, in order to enhance the expression ability of the model and allow the attention mechanism to model the relationship in multiple subspaces independently, the query, key and value vectors are divided into multiple subheads, each subhead corresponds to a lower-dimensional subspace, and subsequent calculations are performed independently in the subspace to prepare for the subsequent clustering step, an additional linear transformation matrix is constructed to map the key vector to a lower-dimensional space, and unit norm normalization is applied to each vector in the space, so as to obtain the normalized low-dimensional key vector tensor;

[0086] Based on the normalized low-dimensional key vector tensor, a unit sphere-based clustering operation is performed, including initializing a set of cluster center vector sets, each cluster center vector having the same dimension as the low-dimensional key vector, and all cluster center vectors being uniformly distributed in space or being initialized by a pre-performed clustering algorithm, for each time step in each sample, the similarity of the normalized low-dimensional key vector at the time step to all cluster center vectors is obtained by calculating the dot product value of the normalized low-dimensional key vector at the time step and all cluster center vectors, the similarity value is normalized using a Softmax function, thereby obtaining a probability distribution of the time step belonging to each cluster, which is used to guide the attention mechanism to subsequently perform calculation only in the highly relevant cluster, thereby improving the overall efficiency;

[0087] A set of key vectors most relevant to each query vector is selected to reduce the computational overhead of the attention mechanism, and the specific method is as follows: first, each query vector is mapped to the same low-dimensional space as the cluster center, and the similarity between the query vector and each cluster center is calculated, and N most relevant clusters are assigned to each query vector according to the similarity value, and the corresponding key vectors from the clusters associated with each query vector are collected as a candidate key vector set;

[0088] Attention calculation is performed on each query vector in the candidate key vector set, specifically: the similarity between the query vector and all vectors in the corresponding candidate key vector set is calculated, the scaled inner product is used as the scoring standard, and the similarity result is converted into a weighting coefficient through an exponential normalization function, and the weighting coefficient is applied to the corresponding value vector, and the output representation of the query vector is obtained by weighted summation, in order to ensure numerical stability, the vector blocks in the candidate key vector set are processed in a block-by-block manner, and cumulative weighted calculation is performed between blocks to ensure the accuracy and efficiency of the overall attention calculation;

[0089] The output vectors of each attention head are spliced together, and the spliced result of the multi-head attention is output, the multi-head attention output is mapped back to the original feature dimension through a linear transformation, the transformed vector is element-wise added to the enhanced time series feature tensor to form a residual connection, and the residual result is subjected to layer normalization processing to stabilize the training process, and the output is the fused time series feature;

[0090] The attention output of each time step, i.e. the fused time series feature, is further aggregated into a global behavior vector representing the entire sequence, in order to improve the expression ability of the embedding vector, a weighted pooling method is used for feature aggregation in the time dimension, specifically: first, a scalar score is calculated for each time step feature vector, the score is generated by a small feedforward neural network, then all scores are normalized to obtain weighting coefficients for each time step, and finally the weighting coefficients are used to weight and sum the feature vectors of each time step, thereby obtaining a high-dimensional behavior embedding vector for the sequence.

[0091] The use of multi-size convolution kernels extracts the local, adjacent and global patterns of behavior, improving the recognition ability of different levels of behavior in the attack chain. The introduction of the hollow convolution and the residual connection expands the receptive field while preserving the low-level information, effectively capturing long-time dependencies. Combined with channel and spatial adaptive attention mechanisms, it dynamically focuses on key behavior time steps and significant feature channels, significantly enhancing the discriminability and robustness of feature expression. With normalization, activation, Dropout and other means, the training stability and generalization ability of the model are improved, thus realizing deep modeling and accurate identification of network threat behavior. By stacking LSTM to capture long-term dependencies in behavior sequences, the gating mechanism effectively avoids gradient disappearance, improving the model's ability to model cross-time attack chains. The introduction of learnable position encoding and random inactivation mechanisms enhances the time perception and robustness of sequence expression. The design of cluster-guided sparse attention mechanism clusters key vectors on a low-dimensional unit sphere and assigns the most relevant cluster to the query vector, significantly reducing attention calculation complexity while maintaining semantic accuracy. The multi-head attention mechanism models behavior correlation in multiple subspaces in parallel, and the residual connection and layer normalization are used to stabilize training and improve generalization ability. Finally, the weighted pooling is used to aggregate behavior vectors to obtain a global sequence embedding with strong expression ability, realizing efficient identification and abstract expression of key attack behaviors.

[0092] Through the deep cooperation of CNN-LSTM-attention mechanism, a multi-dimensional behavior analysis framework for network security is constructed. The multi-scale convolution kernel of CNN extracts atomic behavior features, local interaction patterns and global attack chains in layers; LSTM models the timing dependence and behavior interval regularity of the attack phase; and the adaptive attention mechanism dynamically focuses on key feature dimensions and attack nodes. The three jointly realize the complete analysis of "micro behavior → macro attack chain", significantly improving the detection ability of complex threats such as APT attacks. This framework has two major advantages: 1) spatio-temporal-semantic three-dimensional feature extraction, significantly improving the detection rate of long-period attack chains; 2) robust analysis of adversarial behavior, maintaining high accuracy in encrypted traffic and slow attack scenarios, providing key technical support for building an intelligent defense system with context awareness, tactical understanding and dynamic prediction capabilities.

[0093] Further, the behavior embedding vector is classified as normal or abnormal, and the detected abnormal behavior is labeled into the attack graph node or edge, and the attack graph is dynamically updated. The multi-layer perception is used as a classification model, the behavior embedding vector is input into the classification model, and the normal or abnormal label is output, and the abnormal confidence score is generated. This classification process not only includes the category result, but also includes the detection confidence and possible abnormal type information (such as horizontal movement, malicious scanning, unauthorized access, etc.);

[0094] The multi-layer perception includes an input layer, a shared feature extraction layer, and an output layer;

[0095] The input layer keeps the input layer dimension of the model consistent with the behavior embedding vector dimension;

[0096] The shared feature layer sets 2-3 fully connected layers (128 or 64 neurons per layer), uses ReLU activation function, and adds Dropout (0.3-0.5) after each layer to prevent overfitting;

[0097] The output layer adopts a multi-task output structure, including task 1 (anomaly detection head): outputs two neurons [normal, abnormal], uses Softmax activation function, obtains the probability distribution of normal and abnormal, and calculates the anomaly confidence score,

[0098] Task 2 (anomaly type identification head): outputs multiple neurons (number equal to the number of defined anomaly types, such as horizontal movement, malicious scanning, unauthorized access, etc.), uses Softmax activation function to output the probability distribution of each anomaly type;

[0099] L2 regularization and Dropout are used in the shared feature layer and the output layer to ensure the generalization ability of the model and adapt to real-time detection scenarios;

[0100] Extract behavior samples and corresponding labels from historical data sets, including normal samples and different types of abnormal samples, for class distribution imbalance data, use SMOTE oversampling or weighted loss function to balance training, standardize all embedding vectors (mean is 0, variance is 1), perform PCA dimensionality reduction on embedding vectors according to computing resources to speed up training and inference, use weighted combination form for loss function, including anomaly detection cross-entropy loss and anomaly type classification cross-entropy loss, use Adam optimizer (learning rate 0.001), batch size is set to 128, iterate training until the validation set converges, use the validation set to evaluate F1-score, AUC, recall rate (anomaly recall rate is the focus) and anomaly type classification accuracy, adjust the size of the hidden layer, the proportion of Dropout and the task weight coefficient to obtain the best effect;

[0101] Receive real-time high-dimensional behavior embedding vectors, input into the classification model, output probability distribution from task 1, get anomaly confidence score, compare anomaly confidence score P with preset threshold H, if P is greater than or equal to H, call task 2 to output anomaly type probability distribution, and select the highest probability anomaly type as the prediction result, otherwise directly output the normal label and skip the type identification result;

[0102] According to the classification result, the abnormal behavior is located and labeled, and the entity identifier (such as IP address, user account, device ID, service port, etc.) of the abnormal behavior is searched in the current attack graph to find the corresponding node or edge. If no matching element is found, the entity identifier of the abnormal behavior is added as a new entity or new interaction relationship to the update queue of the graph, and the abnormal related fields in the attribute set of the matched node or edge are increased or updated, including abnormal mark, abnormal type, detection time, abnormal confidence, etc., so that the graph can directly reflect which entity or interaction is in a suspicious state at the semantic level.

[0103] At the same time of completing the abnormal labeling, the attack graph is globally and dynamically updated. The update process is based on all behavior data (including normal and abnormal) received in the current time window, and the graph structure and attributes are synchronously maintained. For the new entity appearing in the window, a corresponding node is created in the graph, and context information such as entity type, network domain, security level, etc. is attached.

[0104] For the new interaction relationship between entities discovered in the window, a new directed edge is created, and the interaction type, direction and initial weight are recorded. For the existing edge, the weight of the edge is adjusted using the weight update formula according to the interaction frequency or intensity in the window, so as to reflect the importance change of the entity relationship. At the same time, the time attributes (such as the latest active time, behavior persistence, change frequency) of all nodes and edges are refreshed.

[0105] After the above labeling and global update, a latest dynamic attack graph containing abnormal information is obtained. The graph not only records all kinds of entities and their interaction relationships in the current system, but also accurately reflects the suspicious activities occurring in recent period at the structure and attribute level. The dynamic graph can be directly used as the input of subsequent graph neural network reasoning and time causal analysis, to predict the development direction of attack chain, identify potential high-risk nodes, and provide real-time basis for dynamic adjustment of security defense strategy.

[0106] Through the cooperative analysis of multi-layer perceptron and dynamic attack graph, efficient and accurate network security threat detection and response are realized. The classification model uses a multi-task architecture to determine behavior abnormality and identify specific attack types. The shared feature layer design effectively extracts key behavior features, and the adaptive threshold mechanism significantly improves detection sensitivity. The dynamic attack graph records the changes in the interaction state between system entities through real-time node / edge update and weight evolution algorithm, and intuitively presents the evolution of attack path. The system supports semantic labeling and time dimension tracking of abnormal behavior, which facilitates security personnel to quickly locate high-risk nodes and analyze attack chains. This technical solution meets the timeliness requirement of real-time detection while maintaining a low false positive rate.

[0107] S3, based on the attack graph, attack stage recognition is performed through a graph neural network, the position of abnormal behavior in the attack chain is located, and a threat response operation is performed;

[0108] Specifically, based on the attack graph, attack stage recognition is performed through a graph neural network, the position of abnormal behavior in the attack chain is located, and a threat response operation is performed;

[0109] The feature vector sequence is input into a time series graph neural network model (such as Temporal Graph Attention Network or Temporal Graph Networks), the model uses an attention mechanism combined with a time decay factor to aggregate the features of adjacent nodes for each node and extract the time series evolution pattern, outputs the stage classification result of the node in the attack chain and its probability distribution, writes the stage classification result back to the corresponding node attribute, realizes accurate positioning of the position of abnormal behavior in the attack chain, and records the stage label, node ID, abnormal type and confidence.

[0110] Through the time series graph neural network modeling of the dynamic attack graph, the stage identification and accurate positioning of the attack behavior are realized, the time series feature aggregation based on the attention mechanism can accurately capture the evolution law of the attack chain, and the discrete abnormal events are associated as a coherent attack tactic sequence. The core advantage of this method is that through the joint analysis of the graph structure and the time series features, the context perception of the abnormal behavior in the attack chain is realized, and the accuracy of attack intent recognition is significantly improved. The dynamically updated stage label provides intuitive attack situation awareness for security operation, supports rapid positioning of key attack nodes and path backtracking, the self-adaptive time decay mechanism effectively identifies slow attack patterns, and reduces the false positive rate of traditional detection methods. Automatic attack stage labeling greatly improves the analysis efficiency and provides structured basis for threat hunting and response decision-making.

[0111] Further, performing a threat response operation means matching a corresponding disposal scheme according to a predefined security policy library. The matching rule of the disposal strategy usually takes the attack stage and the abnormal type as the main decision conditions. For example, when the stage label is "initial access" and the abnormal type is "brute force cracking", the source IP will be immediately blocked and a multi-factor authentication strategy will be triggered;

[0112] When the stage label is "privilege escalation", the operation of limiting the account privilege and resetting the related credential is performed;

[0113] When the stage label is "lateral movement", the affected host is isolated and the communication between it and other nodes is blocked;

[0114] When the stage label is "data leakage", the external transmission channel is interrupted and an emergency audit is started;

[0115] Before performing a specific handling action, the response mode is determined to be automatic execution or manual confirmation according to the abnormal confidence and the handling risk assessment result, so as to avoid misblocking a key business node. After confirming the handling mode, the security control interface is called to call security devices or platforms such as network firewalls, switches, host protection software, and access control systems, and real-time blocking, isolation, restriction, or monitoring instructions are issued;

[0116] Logs, state feedback, and execution results generated during the handling process are collected and written back to the corresponding node attributes of the attack graph in real time, and the handling state (such as "isolated", "blocked", and "monitored") and the handling time of the node are updated, so as to realize closed-loop management of threat response;

[0117] Finally, the updated attack graph is synchronized to a security operation center (SOC) or a situation awareness platform for subsequent analysis, evidence collection, and security policy optimization, realizing real-time linkage of the whole process from detection, positioning to response.

[0118] The embodiment also provides a computer network security threat real-time monitoring system, comprising:

[0119] A data acquisition module is configured to acquire multi-source network data and perform unified preprocessing, and convert the data into a structured JSON format;

[0120] An attack graph construction module is configured to construct an attack graph based on time-series behavior data, and dynamically update the graph structure according to the time attribute of the behavior event and the context information between entities;

[0121] A behavior analysis module is configured to extract spatial and temporal features in the time-series behavior data through an RCLNet architecture, and generate a high-dimensional behavior embedding vector;

[0122] An anomaly detection module is configured to input the generated behavior embedding vector into a classification model, identify abnormal behaviors, and label the abnormal behaviors to nodes or edges of the attack graph, and update the graph in real time;

[0123] A threat response module is configured to analyze the attack graph through a graph neural network, identify the position of the abnormal behavior in the attack chain, and perform a corresponding threat response operation.

[0124] The embodiment also provides a computer device suitable for the computer network security threat real-time monitoring method, comprising a memory and a processor; the memory is configured to store computer executable instructions, and the processor is configured to execute the computer executable instructions to realize the computer network security threat real-time monitoring method proposed in the above embodiment.

[0125] The computer device can be a terminal, and the computer device includes a processor, a memory, a communication interface, a display screen and an input device connected by a system bus. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is configured to perform wired or wireless communication with an external terminal. The wireless communication can be achieved by WIFI, a carrier network, NFC (Near Field Communication) or other technologies. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer overlaid on the display screen, or a key, trackball or touchpad arranged on the shell of the computer device, or an external keyboard, touchpad or mouse, etc.

[0126] The embodiment also provides a storage medium having a computer program stored thereon, the program being executed by a processor to implement the method for monitoring computer network security threats in real time according to the above embodiment. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as a static random access memory (SRAM), an electrically erasable programmable read-only memory (EEPROM), an erasable programmable read-only memory (EPROM), a programmable read-only memory (PROM), a read-only memory (ROM), a magnetic storage, a flash memory, a magnetic disk or an optical disk.

[0127] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present application but not limit the present application. Although the present application has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or replaced equivalently without departing from the spirit and scope of the technical solutions of the present application, and all of them should be covered in the scope of the claims of the present application.

Claims

1. A computer network security threat real-time monitoring method, characterized in that: Comprising, Collecting multi-source network data and preprocessing, organizing multi-source network data into behavior sequences in time sequence to form time-series behavior data for analysis, constructing attack graph based on preprocessed multi-source network data, combining the time attribute of behavior events and the context between entities during graph construction to form a dynamic representation of the attack graph; Inputting the time-series behavior data into the RCLNet architecture for analysis, the RCLNet extracts spatial features through CNN, captures time characteristics through LSTM, and uses an adaptive attention mechanism to focus on key behavior features to generate high-dimensional behavior embedding vectors, classifies the behavior embedding vectors as normal or abnormal, labels the detected abnormal behavior to the attack graph nodes or edges, and dynamically updates the attack graph; Based on the attack graph, attack phase identification is performed through a graph neural network to locate the position of abnormal behavior in the attack chain and perform threat response operations.

2. The method for real-time monitoring of computer network security threats as claimed in claim 1, wherein: The RCLNet extracts spatial features through CNN, captures time characteristics through LSTM, and uses an adaptive attention mechanism to focus on key behavior features to generate high-dimensional behavior embedding vectors, including: Three convolution kernel sizes are used to perform convolution operations on the input time-series behavior data to extract behavior features of different scales, the behavior features of different scales are spliced in the feature dimension to obtain a feature matrix with comprehensive multi-scale information, and the multi-scale feature matrix is post-processed and enhanced to obtain an enhanced multi-scale feature matrix F; The feature matrix F is input into the first layer of the one-dimensional convolution, the kernel size and the inflation rate are set, the input features in the feature matrix F are added to the convolution result using a residual connection, and ReLU activation is performed to obtain the residual enhanced output of the first layer and continue to enter the second layer of the convolution, the output of the current layer is added to the output of the first layer after convolution, and finally the feature matrix E is obtained; The features in the feature matrix F are upsampled using transpose convolution to align the time steps in the feature matrix F and the feature matrix E, and the aligned feature matrix F and the feature matrix E are fused in the channel dimension to obtain a new feature matrix G; The feature matrix G is globally averaged pooled, each channel is averaged along the time dimension to obtain a channel description vector s, a two-layer fully connected network is used to compress and restore the features of the vector s, a Sigmoid activation function is used to generate a channel weight vector β, and the channel weight β is applied to the feature matrix G to obtain a channel-enhanced feature matrix G'; Further apply a spatial attention mechanism to the feature matrix G', including maximum pooling and average pooling along the channel dimension of G' to obtain two single-channel feature maps, concatenate the two single-channel feature maps to form a two-dimensional tensor M, input into a one-dimensional convolution layer with a convolution kernel size of k to generate a spatial attention map γ, and apply the spatial attention map γ to each time step of the feature matrix G' to obtain a final enhanced feature matrix D; The feature matrix D is globally averaged pooled to obtain a two-dimensional tensor containing all time step features. The two-dimensional tensor is input into an LSTM network to obtain a hidden state sequence, i.e., a time sequence feature tensor; Position enhancement is performed on the obtained time sequence feature tensor, three different linear transformations are applied to the enhanced time sequence feature tensor to generate query vectors, key vectors and value vectors, the query vectors, the key vectors and the value vectors are divided into multiple sub-heads, each sub-head independently models the attention relationship in a low-dimensional subspace, the key vectors are mapped to a lower-dimensional space through an additional linear transformation and are normalized by unit norm to obtain a normalized low-dimensional key vector tensor, and a clustering operation is performed on the unit sphere to screen out key vectors most relevant to the query vectors as a candidate key vector set, attention calculation is performed on each query vector in the candidate key vector set, the output of each attention head is mapped back to the original feature dimension through a linear transformation, the transformed vectors are connected in residual with the enhanced time sequence feature tensor, and layer normalization processing is performed to obtain fused time sequence features, and the time sequence features are further aggregated into a global behavior vector representing the entire sequence, and a weighted pooling method is used for feature aggregation in the time dimension to obtain a high-dimensional behavior embedding vector.

3. The method for real-time monitoring of computer network security threats of claim 2, wherein: The behavior embedding vector is classified as normal or abnormal, and the detected abnormal behavior is labeled into an attack graph node or edge, and the attack graph is dynamically updated, wherein a multi-layer perception is used as a classification model, the behavior embedding vector is input into the classification model, and a normal or abnormal label is output, and an abnormal confidence score and abnormal type information are generated, and according to the classification result, the abnormal behavior is positioned and labeled, and the attack graph is globally and dynamically updated.

4. The method for real-time monitoring of computer network security threats of claim 3, wherein: Based on the attack graph, an attack stage is identified through a graph neural network, and the position of the abnormal behavior in the attack chain is located, the attack graph is divided into continuous time sequence snapshots according to a preset time window, and the structural features, attribute features and abnormal confidence of the nodes and edges are encoded to form a feature vector sequence; The feature vector sequence is input into a time sequence graph neural network model, the model uses an attention mechanism combined with a time decay factor to aggregate the features of adjacent nodes and extract the time sequence evolution pattern for each node, and outputs the stage classification result of the node in the attack chain and its probability distribution, and the stage classification result is written back to the corresponding node attribute to realize accurate positioning of the position of the abnormal behavior in the attack chain.

5. The method for real-time monitoring of computer network security threats of claim 4, wherein: The threat response operation is executed, which means that a corresponding disposal scheme is matched according to a predefined security policy library.

6. The method for real-time monitoring of computer network security threats of claim 5, wherein: The multiple-source network data is collected, which means that IoMT device data, network traffic data, user behavior data and host system data are collected and encapsulated into structured JSON objects through a unified data format.

7. The method for real-time monitoring of computer network security threats of claim 6, wherein: The attack graph is constructed based on the preprocessed multiple-source network data, and in the graph construction process, the time attribute of the behavior event and the context between entities are combined to form a dynamic representation of the attack graph, including: All unique entities participating in the behavior are extracted from all behavior data, and are uniformly numbered or classified as nodes in the graph, directed edges are established between entities according to the interaction actions recorded in the behavior data, the frequency of frequently occurring behavior relationships in all data is counted as the initial weight of the edges; Access the latest behavior data stream with a fixed time window and update the attack graph in real time.

8. A computer network security threat real-time monitoring system based on the computer network security threat real-time monitoring method according to any one of claims 1 to 7, characterized in that: The method comprises the steps of: a data acquisition module for collecting multi-source network data and performing unified preprocessing and converting into a structured JSON format; an attack graph construction module for constructing an attack graph based on time-series behavior data and dynamically updating the graph structure according to the time attribute of the behavior event and the context information between entities; a behavior analysis module for extracting spatial and temporal features in the time-series behavior data through an RCLNet architecture and generating high-dimensional behavior embedding vectors; an anomaly detection module for inputting the generated behavior embedding vectors into a classification model, identifying abnormal behaviors and labeling them to nodes or edges of the attack graph, and updating the graph in real time; a threat response module for analyzing the attack graph through a graph neural network, identifying the position of abnormal behaviors in the attack chain and performing corresponding threat response operations.

9. A computer device comprising: A memory and a processor; the memory stores a computer program, and the processor executes the computer program to realize the steps of the computer network security threat real-time monitoring method in any one of claims 1 to 7.

10. A computer readable storage medium having stored thereon a computer program, characterized in that: The computer program is executed by the processor to realize the steps of the computer network security threat real-time monitoring method in any one of claims 1 to 7.

Images