Intelligent dynamic safety monitoring system and method based on multi-modal data fusion

Abstract

The invention discloses an intelligent dynamic security monitoring system and method based on multi-modal data fusion, and the method comprises the steps: capturing a behavior feature sequence of encrypted network traffic through a protocol analysis engine, and obtaining a hardware state vector of an equipment operation log through a security agent interface, extracting metadata fingerprints of the data session through a cross-network ferry monitor to form three types of standardized data streams; the three types of data streams are input into a space-time alignment engine for time window synchronization, feature level fusion is carried out based on an adaptive weight distribution algorithm, and a multi-modal feature matrix containing a network threat index, an equipment health degree score and a ferry risk value is generated; according to the method, an integrated safety monitoring system of cross-domain collaborative awareness and dynamic closed-loop evolution is constructed, and the risk identification precision, the response timeliness and the self-adaptive capability of the system are remarkably improved.

Description

Technical Field

[0001] This application relates to the field of information security monitoring technology, and in particular to an intelligent dynamic security monitoring system and method based on multimodal data fusion. Background Technology

[0002] The security protection of the current industrial internet and critical information infrastructure is facing severe challenges. Traditional security monitoring systems generally adopt a fragmented defense architecture, namely: the network intrusion detection system (IDS) focuses on analyzing encrypted traffic behavior, the device health monitoring platform independently collects hardware operation logs, and the data transfer control system separately audits cross-network sessions.

[0003] There is an implicit chain of correlation between encrypted network attacks (such as APT penetration) and abnormal hardware conditions (such as chip overload), and the isolated operation mode mentioned above cannot link this connection. For example, malicious traffic can induce a sudden rise in device temperature, but existing technology cannot quantify the risk coupling strength between "network threat - device health", resulting in a lack of cascading failure warning.

[0004] Mainstream solutions employ a fixed-weight fusion strategy (such as a constant high weight for network features). When a sudden equipment failure (such as a power efficiency failure) causes security risks, the system struggles to promptly increase the decision weight of the hardware state vector. Furthermore, the risk assessment threshold relies on manual setting and cannot adapt to the topology propagation patterns of new attacks.

[0005] The aforementioned deficiencies result in a double blind spot in security monitoring: On the one hand, the fragmented defense system creates a risk perception gap between the three domains of "network-hardware-ferry"; on the other hand, static strategy mechanisms are becoming increasingly lagging in responding to the ever-evolving hybrid threats. Summary of the Invention

[0006] To address the aforementioned problems, embodiments of the present invention provide an intelligent dynamic security monitoring method based on multimodal data fusion, the method comprising: The protocol parsing engine captures the behavioral feature sequence of encrypted network traffic, the security proxy interface obtains the hardware state vector of the device operation log, and the cross-network ferry listener extracts the metadata fingerprint of the data session to form three types of standardized data streams. The three types of data streams are input into the spatiotemporal alignment engine for time window synchronization, and feature-level fusion is performed based on the adaptive weight allocation algorithm to generate a multimodal feature matrix that includes network threat index, device health score and ferry risk value. A dynamic risk topology map is constructed based on the multimodal feature matrix. When the risk coupling strength between the network threat index and the device health score exceeds the topology threshold, a joint response scheme including access control policy update instructions, device status adjustment requests, and circuit breaker policies is triggered. The policy distributor decomposes the joint response scheme into network protection module instructions, hardware management middleware instructions, and ferry gateway instructions to achieve software-defined cross-domain response.

[0007] Furthermore, the methods for constructing hardware state vectors include: Temperature change rate features are extracted from chip temperature monitoring services, and efficiency fluctuation features are extracted from power conversion logs. After normalization, these features are combined into a device health score.

[0008] Furthermore, the adaptive weight allocation algorithm execution method includes: Assign basic weight coefficients W to the behavioral feature sequences net Its value is positively correlated with the security level of the encryption protocol; Assign dynamic weight coefficients W to the hardware state vector dev Its value increases as the device health score decreases at an increasing rate; The weight allocation satisfies the normalization constraint.

[0009] Furthermore, when the device health score falls below a critical threshold, W is increased. dev Reach the preset ratio limit and activate the abnormal mode depth detection of the hardware state vector.

[0010] Furthermore, the methods for constructing dynamic risk topology graphs include: The row vectors of the multimodal feature matrix are used as topological nodes; The weights of the edges between nodes are calculated based on the probability of the threat propagation path; Risk coupling strength is defined as the topological connection weight between network threat nodes and healthy device nodes.

[0011] Furthermore, the methods for generating metadata fingerprints include: The session duration, data sensitivity labels, and entropy change rate features are extracted by the ferry protocol parser and then converted into a fixed-dimensional risk fingerprint vector through dimensionality reduction encoding.

[0012] Furthermore, the hardware management middleware instruction conversion logic includes: mapping device status control requests to a set of heat dissipation strategy parameters, and forwarding them to the chip temperature control service through the virtualization driver interface.

[0013] Furthermore, the method for determining the topology threshold includes: dynamically updating the threshold boundary through a statistical learning model based on the distribution characteristics of risk coupling strength in historical attack events.

[0014] A smart dynamic security monitoring method based on multimodal data fusion, the method also includes: Collect network behavior characteristics, device health recovery curves, and ferry session status after the joint response scheme is executed, construct an execution effect feedback chain, and update the parameter set of the adaptive weight allocation algorithm based on the feedback chain data.

[0015] An intelligent dynamic safety monitoring system based on multimodal data fusion, comprising: Multi-source probe acquisition module: Captures the behavioral feature sequence of encrypted network traffic through the protocol parsing engine, obtains the hardware status vector of device operation log through the security proxy interface, and extracts the metadata fingerprint of data session through the cross-network ferry listener, forming three types of standardized data streams; Heterogeneous Fusion Module: Inputs three types of data streams into the spatiotemporal alignment engine for time window synchronization, performs feature-level fusion based on an adaptive weight allocation algorithm, and generates a multimodal feature matrix that includes network threat index, device health score and ferry risk value; Coupled Decision Center Module: Constructs a dynamic risk topology map based on the multimodal feature matrix. When the risk coupling strength between the network threat index and the device health score exceeds the topology threshold, it triggers the generation of a joint response scheme that includes access control policy update instructions, device status adjustment requests, and circuit breaker policies. Cross-domain command dispatch module: Through the policy dispatcher, the joint response scheme is decomposed into network protection module commands, hardware management middleware commands, and ferry gateway commands to realize software-defined cross-domain responses.

[0016] The technical effects and advantages of the intelligent dynamic security monitoring method based on multimodal data fusion provided by this invention are as follows: This invention constructs an integrated security monitoring system with cross-domain collaborative perception and dynamic closed-loop evolution, bridging the two major technical bottlenecks of defense blind spots and static policy lag, and significantly improving risk identification accuracy, response timeliness, and system adaptability. Through a spatiotemporal alignment engine and adaptive weight allocation algorithm, this invention integrates network behavior features, device state vectors, and ferry metadata into a unified feature matrix, eliminating semantic barriers between the three domains. Based on a dynamic risk topology map, it calculates the coupling strength between the network threat index and device health score in real time, enabling rapid early warning of cascading risks that traditional solutions cannot identify. It dynamically updates the topology threshold boundary using historical attack data, allowing the risk assessment model to continuously optimize as threats evolve. The hardware management middleware precisely controls chip heat dissipation strategies through a virtualization driver interface, avoiding the waste of computing power caused by global frequency reduction in traditional solutions. Attached Figure Description

[0017] Figure 1 This is a flowchart of the intelligent dynamic security monitoring method based on multimodal data fusion in Example 1; Figure 2 This is a flowchart of the intelligent dynamic security monitoring method based on multimodal data fusion in Example 2; Figure 3 This is a connection diagram of the intelligent dynamic security monitoring system based on multimodal data fusion in Example 3. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] Example 1: Please refer to Figure 1 As shown, embodiments of the present invention provide an intelligent dynamic security monitoring method based on multimodal data fusion, the method comprising: S1. Capture the behavioral feature sequence of encrypted network traffic through the protocol parsing engine, obtain the hardware state vector of the device operation log through the security proxy interface, and extract the metadata fingerprint of the data session through the cross-network ferry listener to form three types of standardized data streams; S2. Input the three types of data streams into the spatiotemporal alignment engine for time window synchronization, perform feature-level fusion based on the adaptive weight allocation algorithm, and generate a multimodal feature matrix containing network threat index, device health score and ferry risk value; S3. Construct a dynamic risk topology map based on the multimodal feature matrix. When the risk coupling strength between the network threat index and the device health score exceeds the topology threshold, trigger the generation of a joint response scheme that includes access control policy update instructions, device status adjustment requests, and circuit breaker policies. S4. The policy distributor decomposes the joint response scheme into network protection module instructions, hardware management middleware instructions, and ferry gateway instructions to achieve software-defined cross-domain response.

[0020] The method for constructing the hardware state vector in step S1 includes: extracting temperature change rate features from the chip temperature monitoring service. For example, when a data center server encounters a sudden load, the chip temperature may surge from 40°C to 85°C within 5 seconds. At this time, the system will record the abnormal temperature rise rate. Extracting efficiency fluctuation features (quantitative parameters that identify the stability of the power module) from the power conversion log (runtime data that records the AC / DC power conversion efficiency). For example, if a power module has a nominal conversion efficiency of 95%, but the actual detection shows that it only reaches 88% for 10 minutes, the system will calculate the cumulative effect of this deviation. After normalization, these are combined into a device health score.

[0021] To address the dimensional differences between temperature and power data, a dynamic baseline adjustment strategy is employed in the normalization process, including: The temperature change rate feature is scaled to the range [0, 1] according to the historical operating range of the equipment. For example, if the normal temperature change rate of a server is ≤0.5℃ / s, when the instantaneous value reaches 2.0℃ / s, its normalized result is 1.0. The power supply efficiency fluctuation characteristics are converted into a relative loss coefficient (the percentage by which the actual efficiency deviates from the nominal value). If the nominal efficiency is 95% and the continuous output is 90%, then the loss coefficient is 5.26%.

[0022] The methods for synthesizing equipment health scores include: A device health score (a scalar value that comprehensively characterizes hardware reliability) is generated through weighted fusion. Equipment health score = γ·f(T) (temperature item) + (1−γ)⋅g(P) (power supply item health score); where the dynamic weight γ (the influence factor of temperature characteristics in the score) is automatically adjusted according to the risk level. For example, when the normalized value of the temperature change rate exceeds 0.8, γ increases from the baseline value of 0.6 to 0.9, amplifying the negative impact of temperature anomalies on the score. The lower the final score, the worse the equipment health status. When the score drops below 0.3, subsequent risk coupling strength detection will be triggered.

[0023] During the generation of the multimodal feature matrix, when the network behavior feature sequence (such as encrypted communication traffic) is fused with the hardware state vector (including device health scores), the system performs dynamic weight allocation: Basic weighting coefficient W net (The baseline importance of network threat analysis in decision-making) is dynamically determined by the security level of the encryption protocol. For example, when a business system is detected to have upgraded to the TLS 1.3 protocol, its security level increases, making W... net The security level assessment, increasing from 0.5 to 0.7, is based on factors such as protocol encryption strength and certificate validity. A higher level indicates greater security. net The larger.

[0024] Dynamic weighting coefficient W dev (Reflecting the contribution of hardware health to overall risk) increases non-linearly with the rate of decline in equipment health score, i.e., W dev ∝∣Δ Device Health Score / Δt∣, for example, when a server fan failure causes the health score to plummet from 0.9 to 0.4 within 30 seconds, the rate of decline triggers W. dev The value jumped from 0.3 to 0.8. This design ensures that in the event of sudden hardware degradation, the system prioritizes physical layer risks.

[0025] The weight allocation always satisfies the normalization constraint (the mathematical basis for ensuring the stability of the decision logic), namely: W net+W dev ≡1, By adjusting the coefficient in real time, W ensures that when network threats increase, net Increase W dev Automatic scaling down occurs when hardware health deteriorates rapidly. dev growth and W net Passive compression.

[0026] In the dynamic fusion modeling process described in step S2, an adaptive weight allocation algorithm is used to perform feature-level fusion of three types of standardized data streams (behavioral feature sequences, hardware state vectors, and data session metadata fingerprints). The adaptive weight allocation algorithm dynamically adjusts the contribution weight of each data stream to the final multimodal feature matrix based on the characteristics of the data source and the current security situation.

[0027] Specifically, the adaptive weighting algorithm assigns a basic weight coefficient W to the behavioral feature sequence captured from encrypted network traffic. net， Basic weighting coefficient W ne The weight W is primarily determined based on the security level of the encrypted protocol being parsed. The higher the security of the protocol itself (e.g., using strong encryption algorithms and the latest version of the protocol), the higher the base weight W of its corresponding behavioral feature sequence in the fusion. net The larger it is, the greater it becomes.

[0028] Simultaneously, the algorithm assigns a dynamic weight coefficient W to the hardware state vector obtained through the security proxy interface. dev； W dev The core characteristic of hardware state vectors is their dynamism: their values ​​are not fixed, but increase with the rate at which the device health score decreases. This means that when the operating state (device health) of a device (such as a server, switch, or critical terminal) begins to deteriorate rapidly (e.g., a sharp increase in CPU temperature or a surge in memory error rate), the importance of hardware state vectors in fusion increases rapidly (W dev (Increased), enabling the fusion model to more keenly capture potential risks at the hardware level.

[0029] More importantly, when real-time monitoring detects that the device health score falls below a preset critical threshold (this threshold represents the boundary where the device enters a high-risk operating state), the adaptive weight allocation algorithm will execute specific enhancement strategies, including: Significantly improve W dev The value is adjusted until a preset upper limit is reached. This upper limit represents the maximum weight ratio that the hardware state vector is allowed to occupy in the fused features under this extreme condition. This ensures that when the device itself has serious health problems, its state information will dominate in the multimodal feature matrix, greatly affecting subsequent risk assessment and decision-making.

[0030] At the same time, the system will activate deep anomaly pattern detection targeting the hardware state vector. This means that it no longer relies solely on conventional threshold alarms or simple trend analysis, but instead initiates a more complex analysis module. Deep anomaly pattern detection includes: Delve into the correlations and anomaly patterns among various sensor data (such as the temperature of multiple cores, error counts of different memory channels, and multidimensional indicators of disk SMART attributes) in the hardware state vector; The comparison is performed by combining the current load of the equipment, historical operating baseline, and a library of typical failure modes of similar equipment.

[0031] Machine learning is used to identify subtle signs or combinations of features that indicate specific hardware failures, such as a disk about to fail completely, an unstable power supply, or a cooling system failure.

[0032] For example: Suppose that the device health score of a critical database server (which integrates CPU temperature, memory ECC error rate, disk response time, etc.) drops sharply from 90 (good) to 55 within a short period of time (the critical threshold is set at 60). At this time, the adaptive weight allocation algorithm will immediately adjust W... dev Increase to a preset limit (e.g., allow W) dev The maximum percentage can reach 60% of the total weight. The abnormal pattern deep detection was triggered. Although the average CPU temperature was only slightly above the standard, the temperature spikes of two cores were frequent and the duration was increasing. At the same time, the "average erase / write cycles" of a certain SSD were close to the nominal life limit and the "bad block remapping rate" was rising rapidly. The abnormal pattern deep detection identified these related patterns as a high-risk combination of "concurrent decrease in heat dissipation efficiency in the early stage of the end of the life of a specific model of SSD". This refined diagnostic information was integrated into the subsequently generated device health score (which may be corrected to a lower risk value, such as 40 points) and output as part of the multimodal feature matrix.

[0033] Through this mechanism, when the health of the equipment is severely degraded, the system not only amplifies the weight of hardware status information, but also provides more accurate and actionable fault diagnosis information through deep detection. This enables the final multimodal feature matrix (including network threat index, equipment health score and ferry risk value) to more realistically and urgently reflect the complex risks currently faced by the system, providing key basis for subsequent joint strategy decisions.

[0034] In the joint strategy decision-making process of step S3, the core step is to construct a dynamic risk topology map based on the multimodal feature matrix generated in step S2. The dynamic risk topology map aims to visualize and quantify the correlations and potential impact paths between different security risk elements. Its construction logic includes: Each row vector of the multimodal feature matrix is ​​regarded as an independent node in the topology graph. Each row vector represents a multidimensional security status index calculated for a monitored entity (such as a physical server, a virtual machine instance, a network boundary device, or a critical application service) within a specific time window. The multidimensional security status index includes the network threat index of the monitored entity (reflecting the risk of it suffering or launching network attacks), the device health score (reflecting the operational stability of its underlying hardware), and the ferry risk value (reflecting the potential violation risk of it participating in cross-network data exchange). Directed edges are established between nodes, and their weights are not fixed or arbitrarily set. Instead, they are dynamically calculated based on the probability of threat propagation paths, relying on predefined or learned threat propagation models. These models characterize the likelihood of different types of risks (such as network intrusion, hardware failure, and unauthorized data leakage) spreading or influencing each other among monitored entities (nodes). For example: What is the likelihood that an attacker will use a node that has been confirmed to have suffered a network intrusion (high network threat index) as a springboard to attempt to intrude into neighboring nodes with which it has frequent communication or a trusted relationship? How likely is it that a node with severely aged hardware (low device health score) will fail, causing the critical service it carries to be interrupted, and thus affecting the business continuity of other nodes that depend on that service? What is the probability that sensitive data carried by a node with high transfer risk will be illegally transferred to a specific target node? The weight of a directed connection edge represents the probability estimate of how a threat or risk propagates from the source node to the target node. The higher the weight, the stronger or more direct the risk transmission path between the two nodes. In the dynamic risk topology graph, the key indicator of risk coupling strength is precisely defined as the topological connection weight between network threat type nodes (i.e., those with significantly high network threat indices) and device health type nodes (i.e., those with significantly low device health scores). The core of risk coupling strength lies in capturing the correlation and amplification effect between network attack activities and device hardware failures, for example: A successful network intrusion (causing a surge in the network threat index of a node) may trigger malicious programs to consume hardware resources excessively (such as mining viruses causing CPU overheating), thereby accelerating the deterioration of device health; conversely, a critical device may cause security protection software to fail or log recording to be interrupted due to hardware failure (sudden drop in health), making it easier for network attackers to exploit and creating a security blind spot.

[0035] Therefore, when the edge weight (i.e. risk coupling strength) between network threat node A and device health node B is very high, it means that the risk states of A and B have a very strong interdependence or amplification relationship, constituting a complex risk point that requires high vigilance.

[0036] For example: Suppose a dynamic risk topology diagram is constructed within a certain time window; The network threat index of node Firewall-01 (firewall device) is as high as 85 (out of 100 indicates extremely high risk), and its device health score is 70 (still within an acceptable range).

[0037] The device health score of node DB-Server-05 (database server) is only 40 (far below the critical threshold of 60 points, indicating a serious risk of failure), and its network threat index is 30 (relatively low).

[0038] Security knowledge base and real-time analysis indicate that attackers often use compromised firewalls as springboards to scan and attack internal database servers (threat propagation path). At the same time, if the database server goes down due to hardware failure, the firewall's critical logs will not be able to be uploaded to the management server (impact path). Therefore, there is an edge in the topology diagram that points from Firewall-01 to DB-Server-05, and its weight (i.e. risk coupling strength) is calculated to be 0.75 (range 0-1, the larger the value, the stronger the risk propagation).

[0039] If the system's preset topology threshold is 0.7, then the risk coupling strength (0.75) between the high network threat of Firewall-01 and the extremely low health of DB-Server-05 has exceeded the threshold. This triggers the system to determine that there is a serious composite threat scenario of "network attacks exploiting hardware vulnerabilities" or "hardware failure amplifying network risks". Subsequently, the system will generate and execute a joint response plan based on this determination (such as simultaneously isolating suspicious firewall traffic, starting hardware hot standby switching for the database server and restricting its cross-network access).

[0040] By constructing and analyzing dynamic risk topology graphs, the system can overcome the limitations of isolated indicators and accurately identify risk transmission chains and key coupling points across multiple dimensions such as network threats, device health, and data transfer. This provides a scientific graph structure basis for the subsequent generation of collaborative access control policy update instructions, device status adjustment requests, and transfer circuit breaker policies.

[0041] In the multi-source heterogeneous data acquisition described in step S1, extracting the metadata fingerprint of the data session through a cross-network ferry listener is one of the key steps in forming three types of standardized data streams. This process is specifically designed for cross-security domain data exchange sessions (i.e., "ferrying" behavior) in a network environment. Its core objective is to generate a fixed-dimensional risk fingerprint vector that can quantify and assess session risk. Specific implementation methods include: The cross-network ferry listener has a built-in ferry protocol parser. This parser performs in-depth analysis of various cross-network data transmission protocols (such as dedicated file exchange protocols, database synchronization protocols, and security isolation gateway communication protocols), extracting raw metadata features highly relevant to security risks. The parser focuses on extracting the following three core features: Session duration: Records the total time from the establishment to the closure of a single data exchange session; unusually long sessions (such as those far exceeding the historical baseline for similar operations) may indicate covert data transmission or penetration activities; unusually short, high-frequency sessions may suggest scanning or probing attacks.

[0042] Data Sensitivity Labeling: Based on a predefined data classification and grading strategy, the data content being transmitted is automatically or semi-automatically labeled with sensitivity tags (such as "Public", "Internal", "Confidential", "Top Secret"). This labeling is determined based on a comprehensive assessment of data content analysis, file attributes, and source / destination context.

[0043] Entropy rate of change characteristic: Calculates and analyzes the rate of change of information entropy in a data stream during transmission. Information entropy is a mathematical indicator that measures the randomness or unpredictability of data. The entropy rate of change characteristic describes the drastic change in the entropy value of a data stream over a time window.

[0044] A high and stable entropy value usually indicates encrypted or strongly compressed data (which may be encrypted normally or maliciously).

[0045] Sudden and drastic fluctuations in entropy (high entropy rate of change) have important security implications, as they may indicate that the encrypted data stream contains plaintext instructions, abnormal data packet size patterns (such as C&C communication), or that the transmitted content suddenly switches from structured data (low entropy) to randomized data (high entropy).

[0046] The extracted raw metadata features (duration, sensitivity tags, entropy change rate sequences, etc.) are usually multidimensional and redundant or correlated. To generate a standardized, fixed-dimensional data stream suitable for subsequent fusion modeling, the system employs dimensionality reduction encoding techniques, including: The original features are transformed and combined. For example, the deviation (Z-score) of "session duration" is calculated by combining it with the historical baseline; "data sensitivity label" is mapped to numerical risk coefficient (e.g., public = 0.1, top secret = 0.9); and statistical features (e.g., maximum value, mean, variance, number of times the threshold is exceeded) are extracted from "entropy rate sequence".

[0047] Algorithms such as Principal Component Analysis (PCA) or Autoencoder are applied to compress (reduce the dimensionality) the engineered feature set into a fixed-dimensional low-dimensional vector space. This process aims to retain the most important risk discrimination information while eliminating noise and redundancy.

[0048] The final output is this fixed-dimensional risk fingerprint vector, which is a refined expression of the original session metadata. Each dimension implicitly encodes key pattern information related to ferry risks (such as data leakage, unauthorized transmission, and covert channels).

[0049] For example: Scenario 1 (Suspected Data Theft): The parser detected an FTP session from the R&D area to the external testing area. Feature extraction revealed: the session duration was 120 minutes (significantly longer than the average transfer time of 15 minutes for similar files); the data sensitivity label was identified as "confidential" (the source file contained design drawings); the entropy rate feature showed a sharp increase in entropy value midway through the transfer (jumping from 0.5 to 0.9 and maintaining it). After dimensionality reduction encoding, the generated risk fingerprint vector showed high values ​​in implicit dimensions representing "abnormal duration," "highly sensitive data," and "sudden high entropy maintenance," strongly suggesting that a large volume of confidential data may have been encrypted and then transmitted.

[0050] Scenario 2 (Covered Communication): A seemingly normal HTTP proxy session (targeting a common news website) has characteristics showing a normal session duration (3 minutes); the data sensitivity label is "public" (the transmitted content appears to be a webpage); however, the entropy change rate feature detects multiple small but rapid entropy value pulse fluctuations (e.g., 0.65->0.75->0.68->0.74, with a fast rate of change); the fingerprint vector after dimensionality reduction encoding is unusually prominent in the "micro-amplitude high-frequency entropy change" dimension, which may indicate that the session is used to embed covert command and control (C&C) communication within normal traffic.

[0051] Through the above mechanism, step S1 ultimately forms three types of standardized real-time data streams that can be efficiently processed by subsequent steps.

[0052] When executing the joint response scheme in step S4, the execution of the device state adjustment request (generated in step S3 based on the dynamic risk topology map) relies on the intelligent conversion capability of the hardware management middleware. The hardware management middleware acts as a translation layer between high-level security policies and low-level hardware control, and its core conversion logic includes: The device status adjustment request issued in step S3 is an abstract security instruction (such as "reduce the hardware risk level of node DB-Server-05" or "prevent node Firewall-01 from failing due to overheating"), rather than a specific hardware operation command. The hardware management middleware has a built-in policy mapping engine that dynamically maps this abstract request into an operable set of heat dissipation policy parameters. The heat dissipation policy parameter set is a pre-configured template for hardware control instructions, including but not limited to: Temperature threshold adjustment value: Set the critical temperature point that triggers active heat dissipation intervention (e.g., reduce it from the default 85°C to 75°C).

[0053] Fan speed curve: Defines the percentage of forced cooling fan speed corresponding to different temperature ranges (e.g., the fan speed is increased to 80% when the temperature is >70°C).

[0054] CPU / GPU frequency limit: Specifies the maximum operating frequency of the processor or the number of cores to disable (e.g., limiting the CPU's maximum frequency to 70% of the base frequency).

[0055] Power consumption cap: Set the upper limit of the device's instantaneous and continuous power consumption (e.g., peak power consumption should not exceed 300W).

[0056] The mapping process takes into account the real-time status of the device and the environment: the middleware will refer to the current hardware monitoring data (such as CPU utilization and ambient temperature), device model characteristics (such as thermal design power TDP) and historical failure modes, and dynamically adjust the specific values ​​of the parameter set to ensure that the heat dissipation strategy is effective without excessively affecting performance.

[0057] The generated set of heat dissipation strategy parameters is not sent directly to the physical hardware, but is forwarded through the virtualization driver interface. The virtualization driver interface is a standardized abstraction layer between the middleware and the underlying hardware services. Its core value includes: shielding the control differences between different manufacturers and models of hardware (such as Intel / AMD servers, NVIDIA GPUs, and customized network devices); ensuring that security control commands are executed in a protected virtualization environment, avoiding the stability risks caused by directly manipulating physical registers; and the virtualization driver interface encapsulates the parameter set into a standard instruction package that can be recognized by the underlying services and reliably forwards it to the chip temperature control service on the target device.

[0058] The chip temperature control service is a lightweight daemon deployed on the device firmware or out-of-band management controller (such as BMC / IPMI). After receiving instruction packets from the virtualization driver interface, it extracts specific control items such as temperature threshold, fan curve, and frequency limit. By accessing hardware interfaces such as the chip's built-in digital temperature sensor (DTS), performance status register (P-States), and fan control unit (FCU), it performs precise heat dissipation regulation, monitors the regulation effect in real time (such as the actual temperature drop rate and fan response speed), and feeds back the execution status to the hardware management middleware to form a control closed loop.

[0059] For example: Suppose that the dynamic risk topology map shows that node GPU-Server-08 (which carries AI training tasks) has both a high network threat index (75) and a rapidly declining device health score (from 80 to 55). Step S3 generates a joint response plan, which includes a device status adjustment request sent to the node: "Immediately curb health deterioration, with priority over performance"; the hardware management middleware performs the following transformation: Based on the server configuration (4 GPUs, TDP 300W / GPU) and the current average GPU temperature (78°C), the mapping engine generates a parameter set, which includes: Temperature threshold: The highest level of response is triggered when the GPU core temperature exceeds 70°C (the original default was 85°C).

[0060] Fan speed: When the temperature is >70°C, the fan is forced to 100% full speed (originally based on the temperature curve at a maximum of 90%).

[0061] GPU frequency: Maximum boost frequency is limited to 60% of the nominal value.

[0062] Power consumption cap: The instantaneous power consumption of each GPU shall not exceed 200W.

[0063] The parameter set is encoded into a standard instruction packet and sent to the out-of-band management controller of GPU-Server-08 through the virtualization driver interface; Service parsing instructions, executed immediately: rewrite the GPU temperature threshold register to 70°C; set the fan control register to full-speed mode; limit the frequency via the GPU driver; enable power monitoring and forced current limiting; Within 5 minutes, the average GPU temperature dropped from 78°C to 65°C, and the device health score stopped declining and rebounded to 60.

[0064] Although the training process was slower, it avoided hardware failures or security malfunctions caused by overheating, which aligns with the strategic objective of "prioritizing the prevention of health deterioration".

[0065] Through this refined instruction conversion and execution mechanism, step S4 can accurately, securely, and efficiently translate the device status control request generated based on global risk perception into specific hardware behavior, thereby achieving immediate containment of device health risks and forming a deeply collaborative joint response with access control policy updates and circuit breaker policies.

[0066] In the joint strategy decision-making process of step S3, when determining whether the risk coupling strength has reached the critical point that requires triggering a joint response, a scientifically set topology threshold is relied upon. This topology threshold is not statically configured, but rather a dynamically optimized intelligent boundary based on in-depth analysis of historical security events. Its determination method includes: The system continuously collects and labels historical attack events, paying particular attention to complex security events involving the intertwining of network attacks and equipment failures (such as ransomware causing CPU overload and triggering hardware failures, or hardware failures causing security protection failures that are exploited by attackers).

[0067] For each historical attack event, the system backtracks the dynamic risk topology map constructed in a specific time window before the event (such as 5-30 minutes before the attack), and accurately extracts the distribution data of all risk coupling strengths (i.e. the edge weights between network threat nodes and healthy device nodes) in the map.

[0068] The statistical analysis engine processes this historical data, focusing on two types of distribution characteristics: Attack event distribution: A set of risk coupling strength values ​​recorded when actual attack events occur; these values ​​represent the strength level of actual risk transmission.

[0069] Baseline normal distribution: a set of risk coupling strength values ​​for the same system during periods of stable operation without attacks; these values ​​represent the intensity level of daily fluctuations or false alarms.

[0070] By comparing these two types of distribution characteristics, the key patterns identified by the system include: The coupling strength of attack events typically exhibits a right-skewed distribution (with a large number of values ​​concentrated in the higher range).

[0071] The coupling strength of the normal baseline exhibits a left-skewed distribution (with a large number of values ​​concentrated in the lower range).

[0072] There is an overlap area between the two, which is the most ambiguous area and the most likely to produce false alarms or missed alarms.

[0073] Based on the above distribution characteristics, the system uses a statistical learning model to dynamically calculate the optimal topological threshold, such as a minimum error rate classifier based on Bayesian decision theory; the core optimization objectives of the statistical learning model include: Maximize attack detection rate (Recall): Ensure that the risk coupling strength of the vast majority of real attack events (e.g., >95%) exceeds the threshold.

[0074] False positive rate control (FPR): Limit the probability of misjudging normal fluctuations as attacks to an acceptable level (e.g., <5%).

[0075] Recall and false positive rate (FPR) are core metrics for evaluating the performance of optimal topology thresholding, including: Detection rate = number of correctly triggered attack events / total number of attack events (the higher the better); False alarm rate = number of falsely triggered normal events / total number of normal events (the lower the better).

[0076] The statistical learning model is automatically updated periodically (e.g., every 24 hours or every 100 new events) to ensure that the threshold always reflects the latest risk characteristics of the current environment. When new composite attack methods emerge and cause the attack distribution to shift to the right, the threshold will be adaptively increased to avoid missed detections.

[0077] When system architecture upgrades or enhanced protection cause the normal baseline to shift to the left, the threshold will be appropriately lowered to maintain sensitivity.

[0078] For example: Historical data analysis phase: The system analyzed 50 confirmed compound attack incidents that occurred in the past 3 months, and the statistics revealed: The median risk coupling strength of the attack event cluster is 0.72, and the 90th percentile is 0.85 (i.e., the coupling strength of 90% of attack events is ≤0.85).

[0079] The median risk coupling strength of the normal baseline group is 0.35, and the 99th percentile is 0.65 (i.e., 99% of normal fluctuations are ≤0.65).

[0080] The overlap area is concentrated in the 0.60-0.70 range (this range contains both a small number of attack events and about 2% of normal fluctuations).

[0081] The statistical learning model, with an optimization objective of "detection rate ≥ 95% and false alarm rate ≤ 3%", calculates the current optimal topology threshold to be 0.68. When the coupling strength is ≥0.68, the system is judged as high-risk coupling (triggering a joint response).

[0082] At the optimal topology threshold: 95% of attack events were correctly detected (because 47.5 out of 50 events had a ≥0.68), while only 2.8% of normal fluctuations were misjudged (meeting the ≤3% requirement).

[0083] A week later, the system suffered a new type of supply chain attack. The attackers exploited a firmware vulnerability to simultaneously trigger device malfunctions and network penetration. Post-incident analysis revealed that the risk coupling strength of all six such incidents was distributed in the range of 0.63-0.67 (below the current threshold of 0.68, resulting in false negatives). The statistical learning model will be updated in the next round. Including these 6 new incidents, the attack distribution has expanded to low-value areas.

[0084] To maintain a 95% detection rate, the topology threshold is automatically lowered to 0.65.

[0085] Meanwhile, the false alarm rate was verified to be controlled at 3.5% (within the tolerance range), and the threshold self-optimization was completed.

[0086] Through this data-driven threshold decision-making mechanism, the system can avoid using rigid fixed thresholds, significantly improve the ability to accurately identify network-hardware composite threats, avoid overreacting to daily fluctuations, and promptly capture truly destructive risk coupling scenarios, ensuring that the joint strategy decision in step S3 is both sensitive and specific.

[0087] Example 2: Figure 2 As shown, this embodiment further improves upon the design of Embodiment 1. The difference is that, in actual operation, Embodiment 1 revealed that the parameter set of the adaptive weight allocation algorithm lacked dynamic adaptability, leading to a mismatch between the response strategy and the real-time threat situation. Specifically, when new hardware attack methods emerge (such as bypassing security detection using GPU overclocking vulnerabilities), the decision weights of the hardware state vector are insufficient, failing to trigger timely heat dissipation control; when facing advanced threats disguised as legitimate traffic, the weights of behavioral feature sequences are too high, causing excessive interception by network policies. After the upgrade of cross-network data exchange protocols, the risk fingerprint vector weights are not adapted, resulting in delayed detection of entropy changes. Therefore, the intelligent dynamic security monitoring method based on multimodal data fusion further includes: Collect network behavior characteristics, device health recovery curves, and ferry session status after the joint response scheme is executed, construct an execution effect feedback chain, and update the parameter set of the adaptive weight allocation algorithm based on the feedback chain data.

[0088] After executing the joint response plan in step S4, this method automatically activates the execution effect feedback mechanism, forming a closed loop of "decision-execution-evaluation-optimization". This mechanism dynamically optimizes the core algorithm parameters by quantitatively analyzing the response effect, ensuring that the system continuously adapts to complex threat environments. The specific process includes: Within a preset feedback window (e.g., 30-60 minutes after response execution), the system simultaneously collects three key performance indicators: Network behavior feature sequence: Monitor the changes in traffic patterns of network nodes affected by the response (such as rate-limited devices and isolated areas), and extract features such as malicious connection interruption rate, legitimate service recovery delay, and scanning and probing frequency.

[0089] Equipment health recovery curve: Records the trajectory of the target equipment's health score over time, and calculates key indicators such as the slope of the recovery curve (health improvement rate), steady-state health level, and health oscillation amplitude.

[0090] Cross-network data exchange session status: Monitor changes in metadata fingerprints of cross-network data exchange sessions, including session success rate, abnormal entropy change rate, and high-risk transmission blocking rate.

[0091] The three key performance indicators mentioned above are aligned by timestamp and associated with the triggered joint response scheme ID and the target devices and network scope of its effect, generating a structured execution effect feedback chain. Each feedback chain fully depicts the trajectory and multi-dimensional impact of a specific response strategy in the real environment.

[0092] The feedback analysis engine, based on accumulated feedback chain data, drives the iteration of core parameters of the adaptive weight allocation algorithm (see step S2); through cluster analysis, it discovers commonalities in response strategies that significantly improve the health slope (e.g., >0.8 points / minute) without causing business interruption (network latency <200ms) (e.g., specific heat dissipation strategy + access control combination); using attribution analysis models (e.g., SHAP value), it calculates the contribution ratio of the weights of various input data (behavioral characteristics, hardware status, risk fingerprints) in S2 to successful responses.

[0093] Simultaneously, the weights are dynamically adjusted based on the contribution level. Adjustment methods include: If the feedback chain shows that the recovery of device health mainly depends on precise hardware control (such as the heat dissipation strategy contributing 70%), then increase the fusion weight of the hardware state vector in S2.

[0094] If the feedback chain indicates that network threat containment dominates risk mitigation (e.g., malicious traffic blocking contributes 80%), then the weight of the behavioral feature sequence is strengthened.

[0095] If a sudden drop in ferry risk (such as a 90% reduction in abnormal entropy sessions) stems from deep protocol analysis, then the decision weight of the risk fingerprint vector should be increased.

[0096] For example: Scenario: In response to a combined event where a firewall policy fails due to CPU overheating (health level drops sharply to 40), the system executes a combined response. Hardware-wise: CPU frequency is limited to 2.0GHz (base frequency 3.5GHz) through chip temperature control service. At the network level: Temporarily block access to high-risk external ports; Feedback chain data collection (60-minute time window) includes: Network characteristics: Malicious connections decreased by 100%, service latency increased by 120ms (acceptable); Health curve: Slope = 1.2 points / minute, steady state recovered to 75 points; Ferry status: High-risk transmissions returned to zero, entropy abnormal sessions decreased by 95%; Attribution analysis shows that in this successful response, hardware control contributed 65% (rapid cooling and stabilizing equipment); network blocking contributed 30% (containing external attacks); and ferry monitoring contributed 5% (assisting verification). Accordingly, the adaptive weight allocation algorithm includes: increasing the weight of the hardware state vector from 0.4 to 0.5; fine-tuning the weight of the behavioral feature sequence from 0.3 to 0.35; and keeping the weight of the risk fingerprint vector at 0.15.

[0097] This feedback mechanism enables the system to continuously evolve. When a new attack causes the original response to fail (e.g., the feedback chain shows a continuous deterioration in health), the failure link is quickly located and its weight is reduced through contribution analysis. When environmental changes alter the risk transmission pattern (e.g., the access of IoT devices increases the weight of hardware risks), the parameter set is dynamically adjusted to prioritize key threats. Ultimately, this achieves real-time adaptation between response strategies and threat situations, ensuring that the joint response plan always addresses network-hardware composite risks with optimal resource allocation.

[0098] Example 3: Figure 3 As shown, based on the same inventive concept as the intelligent dynamic security monitoring method based on multimodal data fusion in the foregoing embodiments, this application provides an intelligent dynamic security monitoring system based on multimodal data fusion. The system and method embodiments in this application are based on the same inventive concept. The system includes: Multi-source probe acquisition module: Captures the behavioral feature sequence of encrypted network traffic through the protocol parsing engine, obtains the hardware status vector of device operation log through the security proxy interface, and extracts the metadata fingerprint of data session through the cross-network ferry listener, forming three types of standardized data streams; Heterogeneous Fusion Module: Inputs three types of data streams into the spatiotemporal alignment engine for time window synchronization, performs feature-level fusion based on an adaptive weight allocation algorithm, and generates a multimodal feature matrix that includes network threat index, device health score and ferry risk value; Coupled Decision Center Module: Constructs a dynamic risk topology map based on the multimodal feature matrix. When the risk coupling strength between the network threat index and the device health score exceeds the topology threshold, it triggers the generation of a joint response scheme that includes access control policy update instructions, device status adjustment requests, and circuit breaker policies. Cross-domain command dispatch module: Through the policy dispatcher, the joint response scheme is decomposed into network protection module commands, hardware management middleware commands, and ferry gateway commands to realize software-defined cross-domain responses.

[0099] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

[0100] The above description is merely a preferred embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present application, based on the technical solution and concept of the present application, should be covered within the scope of protection of the present application.

Claims

1. An intelligent dynamic security monitoring method based on multimodal data fusion, characterized in that, The methods include: The protocol parsing engine captures the behavioral feature sequence of encrypted network traffic, the security proxy interface obtains the hardware state vector of the device operation log, and the cross-network ferry listener extracts the metadata fingerprint of the data session to form three types of standardized data streams. The three types of data streams are input into the spatiotemporal alignment engine for time window synchronization, and feature-level fusion is performed based on the adaptive weight allocation algorithm to generate a multimodal feature matrix that includes network threat index, device health score and ferry risk value. A dynamic risk topology map is constructed based on the multimodal feature matrix. When the risk coupling strength between the network threat index and the device health score exceeds the topology threshold, a joint response scheme including access control policy update instructions, device status adjustment requests, and circuit breaker policies is triggered. The policy distributor decomposes the joint response scheme into network protection module instructions, hardware management middleware instructions, and ferry gateway instructions to achieve software-defined cross-domain response.

2. The intelligent dynamic security monitoring method based on multimodal data fusion according to claim 1, characterized in that, Methods for constructing hardware state vectors include: Temperature change rate features are extracted from chip temperature monitoring services, and efficiency fluctuation features are extracted from power conversion logs. After normalization, these features are combined into a device health score.

3. The intelligent dynamic security monitoring method based on multimodal data fusion according to claim 1, characterized in that, The adaptive weight allocation algorithm execution methods include: Assign basic weight coefficients W to the behavioral feature sequences net Its value is positively correlated with the security level of the encryption protocol; Assign dynamic weight coefficients W to the hardware state vector dev Its value increases as the device health score decreases at an increasing rate; The weight allocation satisfies the normalization constraint.

4. The intelligent dynamic security monitoring method based on multimodal data fusion according to claim 3, characterized in that, When the device health score falls below a critical threshold, increase W. dev Reach the preset ratio limit and activate the abnormal mode depth detection of the hardware state vector.

5. The intelligent dynamic security monitoring method based on multimodal data fusion according to claim 1, characterized in that, Methods for constructing dynamic risk topology diagrams include: The row vectors of the multimodal feature matrix are used as topological nodes; The weights of the edges between nodes are calculated based on the probability of the threat propagation path; Risk coupling strength is defined as the topological connection weight between network threat nodes and healthy device nodes.

6. The intelligent dynamic security monitoring method based on multimodal data fusion according to claim 1, characterized in that, Methods for generating metadata fingerprints include: The session duration, data sensitivity labels, and entropy change rate features are extracted by the ferry protocol parser and then converted into a fixed-dimensional risk fingerprint vector through dimensionality reduction encoding.

7. The intelligent dynamic security monitoring method based on multimodal data fusion according to claim 1, characterized in that, The hardware management middleware instruction conversion logic includes: mapping device status control requests to a set of heat dissipation strategy parameters, and forwarding them to the chip temperature control service through the virtualization driver interface.

8. The intelligent dynamic security monitoring method based on multimodal data fusion according to claim 5, characterized in that, Methods for determining the topology threshold include: dynamically updating the threshold boundary through a statistical learning model based on the distribution characteristics of risk coupling strength in historical attack events.

9. The intelligent dynamic security monitoring method based on multimodal data fusion according to claim 1, characterized in that, The method also includes: Collect network behavior characteristics, device health recovery curves, and ferry session status after the joint response scheme is executed, construct an execution effect feedback chain, and update the parameter set of the adaptive weight allocation algorithm based on the feedback chain data.

10. An intelligent dynamic security monitoring system based on multimodal data fusion, characterized in that, The system includes: Multi-source probe acquisition module: Captures the behavioral feature sequence of encrypted network traffic through the protocol parsing engine, obtains the hardware status vector of device operation log through the security proxy interface, and extracts the metadata fingerprint of data session through the cross-network ferry listener, forming three types of standardized data streams; Heterogeneous fusion module: Inputs three types of data streams into the spatiotemporal alignment engine for time window synchronization, performs feature-level fusion based on an adaptive weight allocation algorithm, and generates a multimodal feature matrix containing network threat index, device health score and ferry risk value; Coupled Decision Center Module: Constructs a dynamic risk topology map based on the multimodal feature matrix. When the risk coupling strength between the network threat index and the device health score exceeds the topology threshold, it triggers the generation of a joint response scheme that includes access control policy update instructions, device status adjustment requests, and circuit breaker policies. Cross-domain command dispatch module: Through the policy dispatcher, the joint response scheme is decomposed into network protection module commands, hardware management middleware commands, and ferry gateway commands to realize software-defined cross-domain responses.

Images