Distributed network security threat prediction system based on federated learning

Abstract

The invention belongs to the technical field of network security, and discloses a federated learning-based distributed network security threat prediction system, which is characterized in that adaptive iteration is driven by threat entropy through a dynamic federated learning scheduling module, emergency update is triggered when a threat feature entropy value exceeds a threshold value, and a model iteration period is greatly compressed; a hierarchical sub-model architecture is combined, so that different domain nodes can pertinently update feature layer parameters, the recognition speed of novel variation threats is remarkably improved, the problem that traditional model recognition is lagged is solved, and it is guaranteed that a system follows up threat changes in time; a privacy enhanced aggregation module is adopted, and parameter security aggregation is realized on the premise of not leaking original data through differential privacy and homomorphic encryption double-layer protection; and meanwhile, heterogeneous data is mapped to a unified feature space by virtue of a federal transfer learning engine, so that the cross-scene model adaptability is improved, the problem of difficulty in data fusion under a centralized architecture is solved, the collaborative advantage of multi-source data is fully played, and the global model precision is improved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and specifically relates to a distributed network security threat prediction system based on federated learning. BACKGROUND

[0002] The network security threat prediction system is widely applied in key fields such as finance, industrial control and energy, can predict threats such as transaction fraud in the financial field, can warn abnormal instructions in the industrial control scene, and can prevent power grid attacks in the energy industry, effectively guaranteeing the network security of each field, and is an important technical support for guaranteeing the key information infrastructure in the digital era; the current network security threats present the composite characteristics of dynamic variation and cross-domain penetration, and the existing threat prediction systems have the following technical problems when responding:

[0003] First, the static learning architecture is difficult to adapt to the dynamic evolution of threats, and the traditional system adopts a fixed cycle update model, which cannot respond to the real-time variation of threats such as ransomware, such as new variants appearing every hour, resulting in a lag in the identification of new threats by the model, and making it difficult to keep up with the changes in threats in a timely manner.

[0004] Second, data silos and privacy barriers restrict collaborative learning, and centralized architecture requires each node to share raw data, while sensitive data in the financial, industrial control and other fields cannot be disclosed due to compliance constraints, making it difficult to integrate cross-domain data, and the global model is limited in precision due to insufficient training data coverage, making it difficult to take advantage of the synergy of multi-source data.

[0005] Third, the cross-scene migration capability and attack-defense linkage are missing, and a single model has poor adaptability in heterogeneous scenes such as finance and industrial control, and the prediction results are only used as alarm outputs, which cannot be directly converted into defense actions, forming a dilemma of "prediction and defense disconnection", and it is difficult to quickly contain the spread of threats. SUMMARY

[0006] The purpose of the present application is to provide a distributed network security threat prediction system based on federated learning to solve the problems raised in the background.

[0007] In order to achieve the above purpose, the present application provides the following technical scheme: a distributed network security threat prediction system based on federated learning, which comprises:

[0008] A dynamic federated learning scheduling module: driven by threat entropy for adaptive scheduling, real-time calculation of node threat feature entropy value, triggering emergency iteration to compress the update cycle when the threshold value is exceeded; adopt a hierarchical model, containing general and scene-specific feature layers, different domain nodes only update the specific layer parameters, and dynamically allocate weights through the attention mechanism to adapt to asymmetric data, providing a real-time updated hierarchical model basis for the federated migration learning engine;

[0009] Federal transfer learning engine: Based on the above hierarchical model, a knowledge graph containing a large number of attack patterns is constructed, and graph neural network (GNN) is used to map heterogeneous data to a unified space to realize cross-domain transfer; the domain discriminator is trained by using the generative adversarial network (GAN) to reduce the difference between the domains and reduce the cross-scene precision decay, and the generated unified feature space is directly input into the cross-modal feature fusion module;

[0010] Privacy-enhanced aggregation module: The double protection of differential privacy and homomorphic encryption is formed, the parameters are uploaded after adding noise and encryption aggregation, and the privacy is guaranteed to reach the GDPR standard; the contribution of the blockchain storage record node is solved, which solves the "free rider" problem and provides support for global model safe aggregation and fair cooperation;

[0011] Attack-defense integrated response engine: combined with the reasoning result and the global model, the prediction result is automatically converted into a defense strategy, which is pushed to the firewall through a standardized interface; dynamically deploy customized honeypot to trap samples and update the training set, forming a positive cycle, which not only realizes active defense but also provides data for cross-modal learning; the generated defense strategy and honeypot sample act on the protection device and the cross-modal feature fusion module respectively, forming a "prediction-defense-sample optimization" closed loop;

[0012] Cross-modal feature fusion module: based on the unified feature space, multi-modal data such as text logs and traffic features are fused, BERT is used to extract log semantic features, CNN is used to extract traffic spatiotemporal features, and the fusion result is provided for the intelligent threat tracing module. Multi-dimensional feature support;

[0013] Intelligent threat tracing module: using the fusion features, combined with federated learning and graph reasoning, the local attack path is aggregated to generate a global trace graph to restore the attack chain; the SHAP value is used to calculate the feature contribution degree to locate the threat key features, and the trace clues are directly pushed to the edge-cloud collaborative reasoning module;

[0014] Edge-cloud collaborative reasoning module: edge deployment pruned model realizes millisecond-level preliminary screening, and high-suspicious samples are transmitted to the cloud for deep reasoning with the complete model; design model distillation mechanism, the cloud distills the knowledge of the deep model to the edge lightweight model, preserves the accuracy and improves the efficiency, and the achievements of each module are converted into real-time threat judgment to form a closed loop.

[0015] Preferably, the dynamic federated learning scheduling module comprises:

[0016] (1) Adaptive iteration mechanism: To cope with the real-time evolution of variant threats, break through the traditional fixed-cycle iteration mode, and design a threat entropy-driven adaptive scheduling mechanism; by calculating the threat characteristic entropy value (measuring the threat variation degree) of the local data of each node in real time, when the entropy value exceeds the set threshold, trigger an emergency iteration, greatly compress the model update cycle, and ensure that the threat characteristic changes can be captured in time;

[0017] Threat characteristic entropy calculation formula:

[0018]

[0019] In the formula: H represents the threat characteristic entropy, which is used to quantify the variation degree of the threat characteristics in the current network, and the larger the value is, the more dispersed the threat characteristic distribution is (the more violent the variation is);

[0020] N represents the total number of threat characteristics, such as virus characteristics, vulnerability exploitation characteristics, and abnormal traffic characteristics;

[0021] represents the occurrence probability of the i-th threat characteristic in the local data of the current node, and the calculation method is "the number of samples of the i-th threat characteristic / total number of samples", and satisfies ;

[0022] The formula is used in the "threat entropy-driven adaptive scheduling mechanism" in the dynamic federated learning scheduling module; when the calculated H exceeds the preset threshold (such as H>0.8), the emergency iteration mechanism is triggered, the model update cycle is compressed, and the system can respond to the variation of threat characteristics in time;

[0023] (2) Hierarchical model architecture: Introducing a hierarchical model architecture, the global model includes a basic feature layer (general threat characteristics, such as network protocol types, port scanning behavior identification, and cross-scene common characteristics) and a domain adaptation layer (scene-specific characteristics, such as transaction anomaly characteristics in the financial field and device instruction anomaly characteristics in the industrial control field); financial, industrial control and other different domain nodes only update the domain adaptation layer parameters, and dynamically allocate the weights of the two layers (the information gain ratio of general characteristics and specific characteristics drives the weight adjustment) through the attention mechanism, accurately adapt to the asymmetric data distribution, and provide a scene-customized model basis for the federated transfer learning engine.

[0024] Preferably, the federated transfer learning engine comprises:

[0025] ​(1) Cross-domain feature mapping: Based on the hierarchical model, further solve the cross-scene adaptation problem, design cross-domain threat feature mapping algorithm, through the construction of network security exclusive threat feature knowledge graph (including attack type-vulnerability ID-asset type triple relationship, such as "ransomware exploits CVE-2023-xxx vulnerability to attack server"), using graph attention network (GAT) to learn the association weight of attack mode and vulnerability (such as "SQL injection" and "port 3306" scene association), map the heterogeneous data of different nodes (such as financial transaction logs and industrial control device instructions) to a unified feature space, realize cross-domain feature migration;

[0026] (2) Domain adaptation optimization: Design an adversarial domain adaptation module, train a domain discriminator using a generative adversarial network (GAN), significantly reduce the precision decay of the model when migrating across scenes by minimizing the domain distribution difference loss; The generated unified feature space provides a consistent feature basis for the cross-modal feature fusion module, improving the effectiveness of data fusion;

[0027] Domain distribution difference loss function:

[0028]

[0029] In the formula: represents the domain distribution difference loss, which is used to quantify the difference between the source domain and the target domain data distribution, and the smaller the value, the closer the domain distribution;

[0030] represents the source domain data set (such as the historical threat data of the financial node);

[0031] represents the target domain data set (such as real-time threat data of the industrial control node);

[0032] represents the output of the domain discriminator model, which is used to determine whether the sample comes from the source domain or the target domain, and the output value range is [0, 1] (close to 1 indicates that it is determined as the source domain, and close to 0 indicates that it is determined as the target domain);

[0033] represents the mathematical expectation, which takes the expectation of the discrimination results of the source domain and target domain samples respectively;

[0034] The formula is used for the "adversarial domain adaptation module" of the federated transfer learning engine, which trains the domain discriminator D and the feature extractor in an adversarial manner by minimizing , forcing the feature extractor to generate domain-independent features, thereby reducing the model precision decay when migrating across scenes (such as finance to industrial control).

[0035] Preferably, the privacy-enhanced aggregation module comprises:

[0036] (1) Double-layer privacy protection: On the basis of cross-domain feature sharing realized by the federal migration learning engine, the focus is on protecting data privacy, and a double-layer collaborative protection mechanism combining differential privacy and homomorphic encryption is adopted: the node locally realizes gradient perturbation through Laplace noise (privacy budget e e (0, 2], meeting the "unidentifiable" requirement of GDPR) to prevent local parameter leakage; the cloud directly aggregates encrypted parameters through full homomorphic encryption to avoid privacy leakage in the aggregation process; the two work together to realize "local-global" full-link privacy protection while minimizing the impact on model accuracy;

[0037] Differential privacy gradient perturbation formula:

[0038]

[0039] In the formula: represents the gradient parameter after adding noise, which is uploaded to the central server for aggregation;

[0040] represents the original gradient parameter generated by the node local model training;

[0041] represents the Laplace distribution;

[0042] represents the gradient sensitivity, defined as "the maximum difference of gradients in different training data sets";

[0043] is the data set that differs by only one sample;

[0044] represents the privacy budget, and the smaller the value, the higher the privacy protection strength (usually to meet the "unidentifiable" requirement of GDPR);

[0045] The formula is used for the "double-layer privacy protection mechanism" of the privacy-enhanced aggregation module. By adding Laplace noise to the original gradient g, it ensures that the gradient information of a single node cannot be restored, while meeting the strict definition of differential privacy, providing privacy security for cross-node model aggregation;

[0046] (2) Fair cooperation mechanism: Join the blockchain storage mechanism to write the hash value of each model update parameter into the alliance chain, and record the node contribution degree (based on the model accuracy improvement amount) through the smart contract, effectively solving the "free rider" node problem in federated learning, providing support for the safe aggregation and fair cooperation of the global model, and ensuring the reliability of subsequent reasoning.

[0047] Preferably, the attack and defense integrated response engine comprises:

[0048] (1) Defense strategy conversion: Based on the global model generated by the privacy-enhanced aggregation module, a prediction-defense closed-loop system is constructed. The threat prediction results are automatically converted into defense strategies, and the rules are pushed to the firewall through standardized interfaces (such as OpenFlow), realizing rapid response and converting prediction ability into actual defense actions;

[0049] (2) Sample expansion cycle: Design a virtual honeypot trapping module, based on the predicted attack path, dynamically deploy customized honeypots on edge nodes, such as simulating the existence of specific vulnerabilities in databases; trap attack samples and automatically update them to the local training set, forming a "prediction → trapping → sample expansion → model optimization" positive cycle, providing new data sources for the cross-modal feature fusion module.

[0050] Preferably, the cross-modal feature fusion module comprises:

[0051] (1) Multi-modal data processing: Combine multi-source data obtained by the attack-defense integrated response engine to break through the limitations of single data type, fuse multi-modal data such as text logs, traffic features, file hashes, etc.; use BERT model to extract semantic features of log text, use CNN to extract spatiotemporal features of traffic, and realize multi-modal feature fusion through the cross-attention mechanism of Transformer;

[0052] (2) Time series feature enhancement: Introduce time series feature enhancement algorithm, use attention mechanism to enhance time series feature weight for periodic attacks, and extend the prediction lead time of periodic threats; the fused features not only improve the prediction accuracy, but also provide more rich feature dimensions for the intelligent threat tracing module.

[0053] Preferably, the intelligent threat tracing module comprises:

[0054] (1) Attack chain restoration: Use the multi-dimensional features provided by the cross-modal feature fusion module to realize accurate positioning of the threat source, combine federated learning and graph reasoning technology, use the local attack path graph uploaded by each node, including source IP, attack target, and exploit vulnerability, generate a global attack tracing graph through federated GNN aggregation, realize cross-node attack chain restoration;

[0055] (2) Feature attribution analysis: Develop an attribution analysis algorithm based on SHAP value to calculate the contribution of each feature to the prediction result, and automatically locate the key features of the threat source; the tracing result provides key threat clues for the edge-cloud collaborative reasoning module, reduces the blindness of reasoning, and improves the reasoning efficiency;

[0056] Feature contribution SHAP value calculation formula:

[0057]

[0058] SHAP value representing the i-th feature, quantifying the contribution of this feature to the threat prediction result (positive value means enhancing threat probability, negative value means reducing threat probability);

[0059]

[0060] Any subset of the F that does not contain the i-th feature (i.e.

[0061]

[0062]

[0063] The formula is used for the "feature attribution analysis algorithm" of the intelligent threat tracing module, which locates the key features (such as specific malicious IP, abnormal port) that have the greatest impact on the threat prediction result by calculating the SHAP value of each feature, provides accurate clues for attack chain restoration, and improves the efficiency of cross-node threat tracing.

[0064]

[0065] Preferably, the edge-cloud collaborative inference module comprises:

[0066] (1) Hierarchical inference architecture: based on the threat clues locked by the intelligent threat tracing module, an edge node lightweight inference + cloud deep inference architecture is adopted; the edge node deploys a pruned lightweight model to realize millisecond-level local threat preliminary screening; high-suspicious samples are uploaded to the cloud for deep inference using a complete model, balancing real-time performance and accuracy;

[0067] (2) Knowledge distillation optimization: a model distillation mechanism is designed, and the knowledge (such as softmax output probability) of the deep model is distilled to the edge lightweight model to ensure the inference accuracy of the edge model while greatly improving the computational efficiency; the edge-cloud collaborative inference module as the inference terminal of the system converts the achievements of the previous modules into real-time threat judgment, forming a complete prediction closed loop.

[0068] ​​​​​​​​​​The hierarchical model parameters (basic feature layer weight + domain adaptation layer weight) output by the dynamic federated learning scheduling module are transmitted in JSON format to the cross-domain feature mapping unit of the federated transfer learning engine as the initial model basis for heterogeneous data mapping.

[0069] The unified feature space data generated by the federated transfer learning engine is input into the Transformer layer of the cross-modal feature fusion module in the form of a feature vector matrix (dimension [sample number x 512]);

[0070] The fusion features (including semantic features + spatio-temporal features) of the cross-modal feature fusion module are transmitted in tensor form (dimension [sample number x 1024 x time step]) to the federated GNN input layer of the intelligent threat tracing module;

[0071] The global tracing graph (including attack path nodes and edge weights) and the SHAP value TOP5 feature list (such as ["malicious IP: 192.168.1.1", "port: 445", "vulnerability: CVE-2023-xxx"]) output by the intelligent threat tracing module are used as the priority reasoning clues for the edge-cloud collaborative reasoning module.

[0072] The hierarchical model of the dynamic federated learning scheduling module provides a unified general feature benchmark for the federated transfer learning engine, improving the stability of cross-domain mapping;

[0073] The double-layer protection of the privacy-enhanced aggregation module enables the federated transfer learning engine to safely utilize more cross-domain data and avoid data waste due to privacy restrictions;

[0074] The honeypot samples of the attack-defense integrated response engine continuously supplement the training data for the cross-modal feature fusion module, supporting dynamic optimization of the model.

[0075] The beneficial effects of the present application are as follows:

[0076] 1. The dynamic federated learning scheduling module of the present application is driven by threat entropy to adaptively iterate, triggering an emergency update when the threat feature entropy value exceeds the threshold, significantly reducing the model iteration period. In combination with the hierarchical sub-model architecture, different domain nodes can update the feature layer parameters, significantly improving the recognition speed of new variant threats, solving the problem of recognition lag of traditional models, and ensuring timely follow-up of system changes to threats.

[0077] 2. The privacy-enhanced aggregation module of the present application realizes safe aggregation of parameters without revealing the original data through double-layer protection of differential privacy and homomorphic encryption. At the same time, with the help of the federated transfer learning engine, heterogeneous data is mapped to a unified feature space, improving the cross-scenario model adaptability, overcoming the difficulty of data fusion under centralized architecture, fully utilizing the collaborative advantages of multi-source data, and improving the global model accuracy.

[0078] 3、The application realizes real-time threat judgment and rapid response through the attack and defense integrated response engine, threat prediction results are automatically converted into defense strategies and pushed to the protection device, honeypot traps are dynamically deployed to capture samples and the model is optimized, edge-cloud collaborative reasoning is combined to form a complete closed loop, the problem of lag in the prediction to defense link is solved, threat diffusion is effectively curbed, and the initiative and efficiency of network security protection are improved. BRIEF DESCRIPTION OF DRAWINGS

[0079] Figure 1 A flowchart of the distributed network security threat prediction system based on federated learning is provided. DETAILED DESCRIPTION

[0080] The technical solutions in the embodiments of the application will be described clearly and completely below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only a part of the embodiments of the application, rather than all the embodiments of the application. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the application.

[0081] As shown in Figure 1 The embodiments of the application provide a distributed network security threat prediction system based on federated learning, which comprises:

[0082] A dynamic federated learning scheduling module: threat entropy is used to drive adaptive scheduling, the threat feature entropy value of a computing node is calculated in real time, and an emergency iteration is triggered to compress the update period when the threshold value is exceeded; a hierarchical model is used, which contains general and scene-specific feature layers, and only the specific layer parameters of different domain nodes are updated, the weight is dynamically allocated by an attention mechanism to adapt to asymmetric data, and a basis is provided for a federated transfer learning engine;

[0083] A federated transfer learning engine: relying on a hierarchical model, a knowledge graph containing a large number of attack patterns is constructed, graph neural network (GNN) is used to map heterogeneous data to a unified space to realize cross-domain migration; a domain discriminator is trained by using a generative adversarial network (GAN) to reduce the difference between domains and reduce the cross-scene precision decay, and the unified space generated thereby provides consistent features for a cross-modal feature fusion module;

[0084] A privacy-enhanced aggregation module: differential privacy and homomorphic encryption are combined to form a double-layer protection, noise is added and encryption is performed before parameter uploading and aggregation, privacy is guaranteed to reach the GDPR standard, and the contribution of a block chain storage record node is recorded to solve the problem of "free riding" and provide support for global model safe aggregation and fair cooperation;

[0085] Attack-defense integration response engine: Based on the global model, the prediction results are automatically converted into defense strategies and pushed to the firewall through a standardized interface; dynamic deployment of customized honeypots traps samples and updates the training set, forming a positive cycle, which not only realizes active defense but also provides data for cross-modal learning;

[0086] Cross-modal feature fusion module: fuse multi-modal data such as text logs and traffic features, extract log semantic features with BERT, extract traffic spatiotemporal features with CNN, and fuse them through Transformer, strengthen periodic attack timing features to extend prediction lead time, improve accuracy and provide features for tracing;

[0087] Intelligent threat tracing module: use multi-dimensional features, combine federated learning and graph reasoning, aggregate local attack paths to generate global trace graphs and restore attack chains; use SHAP value to calculate feature contribution to locate threat key features and provide clues for edge-cloud collaborative reasoning module to improve efficiency;

[0088] Edge-cloud collaborative reasoning module: edge deployment pruned model realizes millisecond-level preliminary screening, and high-suspicious samples are transmitted to the cloud for deep reasoning with a complete model; design model distillation mechanism, cloud distills the knowledge of deep model to edge lightweight model, preserves accuracy and improves efficiency, and converts the achievements of each module into real-time threat judgment to form a closed loop.

[0089] Among them, the dynamic federated learning scheduling module includes:

[0090] (1) Adaptive iteration mechanism: to cope with the real-time evolution of variant threats, break through the traditional fixed cycle iteration mode, and design a threat entropy-driven adaptive scheduling mechanism; by calculating the threat feature entropy value (measuring the threat variation degree) of each node's local data in real time, when the entropy value exceeds the set threshold, trigger an emergency iteration, greatly compress the model update cycle, and ensure that the threat feature changes can be captured in time;

[0091] Adopt sliding window mechanism (window size is set to 10 minutes), only calculate the threat feature entropy of the newly added data in the window, update the probability value by increment (not full data recalculation) to reduce the computational overhead, the window sliding interval is 1 minute, and the entropy value update delay is ≤5 seconds;

[0092] Threat feature entropy calculation formula:

[0093]

[0094] In the formula: represents the threat feature entropy, which is used to quantify the variation degree of the threat features in the current network, the larger the value, the more dispersed the threat feature distribution (the more violent the variation);

[0095] Total number of categories representing threat features, such as virus features, vulnerability exploitation features, abnormal traffic features, etc.

[0096] Probability of occurrence of the i-th threat feature in the current node local data, calculated as "number of samples of the i-th feature / total number of samples", and satisfying

[0097] This formula is used in the "threat entropy driven adaptive scheduling mechanism" in the dynamic federated learning scheduling module; when the calculated H exceeds the preset threshold (such as H>0.8), the emergency iteration mechanism is triggered to compress the model update period, ensuring that the system responds to the variation of threat features in time;

[0098] The setting basis of threat entropy threshold H>0.8: based on the test of historical threat samples (including ransomware, DDoS and other types of attacks), when H≤0.8, the variation degree of threat features is low, and fixed period iteration can meet the demand; when H>0.8, the variation degree increases significantly, and emergency iteration (compressing the period to 1 / 5 of the original) needs to be triggered to ensure timely capture of threat feature changes;

[0099] (2) Hierarchical model architecture: introduce hierarchical model architecture, global model contains basic feature layer (general threat features) and domain adaptation layer (scene specific features); financial, industrial control and other different domain nodes only update domain adaptation layer parameters, and dynamically allocate weights of two layers through attention mechanism, adapt to asymmetric data distribution, and provide flexible model basis for federated transfer learning engine;

[0100] New nodes need to pass identity authentication (based on digital certificate), submit local data feature distribution report, and then be assigned initial hierarchical model parameters by cloud server; when a node exits, its historical parameters are traced through the hash value of blockchain evidence, the global model automatically excludes the node's parameter contribution in the last 3 rounds of iteration, and re-aggregates the remaining node parameters;

[0101] The general threat features contained in the basic feature layer include: network protocol type (TCP / UDP / ICMP), port scanning behavior identification, abnormal connection frequency threshold (such as more than 100 connections in 5 minutes), general vulnerability types (such as buffer overflow, injection attack), etc., covering threat attributes common to all scenes;

[0102] Attention mechanism weight allocation logic: set the weight of basic feature layer as α, and the weight of domain adaptation layer as β (α+β=1), and dynamically adjust it by calculating the information gain ratio (IGR) of general features and specific features in the current node data, that is, α= / ( + ​​), β = 1 - a; when the exclusive feature information gain is higher (such as device instruction exception in industrial control scene), β is automatically increased.

[0103] wherein the federated transfer learning engine comprises:

[0104] (1) Cross-domain feature mapping: based on the hierarchical model, further solve the cross-scene adaptation problem, design cross-domain threat feature mapping algorithm, by constructing a threat feature knowledge graph containing a large number of attack patterns and vulnerability features, using graph neural network (GNN) to map heterogeneous data of different nodes to a unified feature space, realizing cross-domain feature transfer;

[0105] The core entities of the threat feature knowledge graph include attack types (such as DDoS, ransomware), vulnerability IDs (such as CVE numbers), asset types (such as servers, PLC devices), and attack tools (such as Metasploit); the core relationships include 'attack type exploits vulnerability', 'vulnerability affects asset type', 'attack tool is associated with attack type', etc., and are stored in triples (head entity, relationship, tail entity);

[0106] The knowledge graph is stored in a graph database (such as Neo4j) and supports fast triple query; new attack patterns are updated through the abnormal feature detection of the cross-modal feature fusion module, and after manual review (high risk) or automatic verification (low risk, matching existing attack patterns with a similarity of ≥80%), new entities / relationships are written into the graph;

[0107] The cross-domain feature mapping uses graph attention network (GAT), because: compared with GCN, the attention mechanism of GAT can automatically learn the association weight between attack patterns and vulnerability features (such as the association weight between 'SQL injection' and 'port 3306'), and is more suitable for the mapping requirements of heterogeneous data (financial transaction logs and industrial control device instructions);

[0108] The negative sample uses the 'random replacement' strategy: for the positive sample triple (attack type A, exploits, vulnerability B), randomly replace the head entity with an unrelated attack type (such as replacing SQL injection with DDoS) or the tail entity with an unrelated vulnerability (such as replacing CVE-2023-xxx with CVE-2020-xxx), and the ratio of negative samples to positive samples is set to 1:1;

[0109] (2) Domain adaptation optimization: design an adversarial domain adaptation module, use a generative adversarial network (GAN) to train a domain discriminator, and minimize the distribution difference loss between domains to significantly reduce the precision decay of the model during cross-scene transfer; the generated unified feature space provides a consistent feature basis for the cross-modal feature fusion module, improving the effectiveness of data fusion;

[0110] The domain discriminator adopts a 3-layer fully connected network: the input layer has a dimension of the unified feature space dimension (512 dimensions), hidden layer 1 has a dimension of 256 (ReLU activation), hidden layer 2 has a dimension of 128 (LeakyReLU activation), and the output layer has a dimension of 1 (Sigmoid activation) and is used to output the probability that the sample comes from the source domain / target domain;

[0111] The inter-domain distribution difference loss function is:

[0112]

[0113] In the formula: represents the inter-domain distribution difference loss, which is used to quantify the difference between the source domain and the target domain data distribution, and the smaller the value is, the closer the inter-domain distribution is;

[0114] represents the source domain data set (such as historical threat data of the financial node);

[0115] represents the target domain data set (such as real-time threat data of the industrial control node);

[0116] represents the output of the domain discriminator model, which is used to judge whether the sample comes from the source domain or the target domain, and the output value ranges from 0 to 1 (close to 1 indicates that it is judged as the source domain, and close to 0 indicates that it is judged as the target domain);

[0117] represents the mathematical expectation, which takes the expectation of the discrimination results of the source domain and target domain samples respectively;

[0118] The formula is used in the "adversarial domain adaptation module" of the federated transfer learning engine, which trains the domain discriminator D and the feature extractor to learn adversarially by minimizing , and forces the feature extractor to generate domain-independent features, thereby reducing the model accuracy degradation when transferring across scenarios (such as finance to industrial control).

[0119] Among them, the privacy-enhanced aggregation module includes:

[0120] (1) Double-layer privacy protection: on the basis of realizing cross-domain feature sharing in the federated transfer learning engine, the focus is on protecting data privacy, and a double-layer protection mechanism combining differential privacy and homomorphic encryption is adopted. Before uploading the model parameters, Laplace noise is added to the gradient to meet the differential privacy requirement; full homomorphic encryption (FHE) is used to aggregate and calculate the encrypted parameters, ensuring that the server cannot decrypt individual node parameters;

[0121] Laplace noise adding timing: after the node local model calculates the original gradient g through one back propagation, immediately add noise through the differential privacy gradient perturbation formula before uploading the gradient to the aggregation server, to ensure that the noise is embedded before the parameter transmission;

[0122] The key of the homomorphic encryption is generated by the cloud server, and the sub-key is distributed to each node through secure multi-party computation (SMPC); the key is automatically rotated every 72 hours, and the new key is pushed through an encrypted channel; when the node key is lost, it needs to resubmit the identity authentication, and the cloud re-distributes the key based on the historical public key stored in the blockchain;

[0123] Differential privacy gradient perturbation formula:

[0124]

[0125] In the formula: represents the gradient parameter after adding noise, which is used to upload to the central server for aggregation;

[0126] represents the original gradient parameter generated by the node local model training;

[0127] represents the Laplace distribution;

[0128] represents the gradient sensitivity, defined as the maximum difference of the gradient in different training data sets;

[0129] is the data set that only differs by one sample;

[0130] represents the privacy budget, the smaller the value, the higher the privacy protection strength (usually to meet the GDPR “unidentifiable” requirement);

[0131] The recommended value of privacy budget is 1.5, according to the following: when =1, the privacy protection strength meets the GDPR “unidentifiable” requirement, but the model accuracy is affected to a certain extent; when =2, the accuracy is less affected, but the privacy risk is higher; when =1.5, a balance is achieved between accuracy and privacy security, and the accuracy can be gradually restored after multiple rounds of federal iteration;

[0132] Linear distribution strategy is adopted, assuming that the total number of iterations is T, and the privacy budget of each round is =6, T=10, then the privacy budget of each round is =0.6), to ensure that the cumulative privacy leakage does not exceed the total budget, and the of the later iterations can be appropriately reduced (such as reducing to 0.4 in the last 3 rounds);

[0133] The formula is used for the "double privacy protection mechanism" of the privacy-enhanced aggregation module, which ensures that the gradient information of a single node cannot be restored by adding Laplace noise to the original gradient g, while meeting the strict definition of differential privacy, providing privacy security for cross-node model aggregation;

[0134] (2) Fair cooperation mechanism: add a block chain evidence mechanism, write the parameter hash value of each model update into the alliance chain, record the node contribution degree (based on the model accuracy improvement amount) through the smart contract, effectively solve the "free rider" node problem in federated learning, provide support for the safe aggregation and fair cooperation of the global model, and ensure the reliability of subsequent reasoning;

[0135] The parameter hash value is generated by SHA-256 algorithm: SHA-256 hash calculation is performed on the encrypted gradient parameters (byte stream) uploaded by the node, and a 256-bit hash value is generated, which is written into the alliance chain block to ensure the integrity of the parameters;

[0136] The alliance chain nodes are composed of edge nodes of each participating institution (such as bank branch servers, power plant industrial control nodes) and 1 cloud consensus node, using PBFT consensus mechanism (block time 5 seconds); the smart contract calculation node contribution degree formula is: contribution degree = (node local model accuracy improvement on the global test set ÷ total improvement of all nodes) x 100%, which is automatically executed and written into the block after each global model aggregation, and the nodes with a certain proportion of contribution degree can obtain the priority of model update in the next round.

[0137] Among them, the attack-defense integrated response engine includes:

[0138] (1) Defense strategy conversion: based on the global model generated by the privacy-enhanced aggregation module, a prediction-defense closed-loop system is constructed. The threat prediction results are automatically converted into defense strategies, and the rules are pushed to the firewall through standardized interfaces (such as OpenFlow), realizing rapid response and converting prediction ability into actual defense actions;

[0139] At the same time, when multiple threats (such as SQL injection and DDoS) are predicted, the execution priority of the firewall rules is sorted according to the threat impact range (core assets > non-core assets) and attack speed (DDoS > slow penetration), and the priority weight formula is: priority = 0.6 x impact range weight + 0.4 x attack speed weight, the weight value is 1-5 (5 is the highest), and the rules are executed in descending order of priority;

[0140] Prediction result and firewall rule mapping example: when predicting 'SQL injection attack', automatically generate rule:'source IP arbitrary, destination port 3306 / 1433, protocol TCP, match string "unionselect" "or1=1", action block and record log'; when predicting 'DDoS attack', generate rule: single IP connection number exceeds 500 times in 1 minute, action limit to 10 times / minute;

[0141] (2) Sample expansion cycle: design a virtual honeypot trapping module, based on the predicted attack path, dynamically deploy customized honeypot on the edge node, such as simulating a database with specific vulnerabilities; trap attack samples and automatically update to the local training set, forming a "prediction -> trapping -> sample expansion -> model optimization" positive cycle, providing new data sources for the cross-modal feature fusion module;

[0142] Honeypot deployment trigger condition: when the risk level of threat prediction reaches 'high' (based on threat probability ≥ 70% and impact range containing core assets), the edge node automatically deploys customized honeypot; when the risk level is'medium', only deploy in non-core areas; when the risk level is 'low', do not deploy;

[0143] The evaluation indicators of the trapping effect of the honeypot include: the number of trapped samples, attack duration, and attacker interaction depth (such as whether to attempt exploit); when there are no new samples for 48 hours, or the attacker exits within 10 minutes and has no effective interaction, the honeypot is determined to be ineffective, and one of the three preset backup honeypot templates is automatically switched to.

[0144] Among them, the cross-modal feature fusion module includes:

[0145] (1) Multi-modal data processing: combine multi-source data obtained by the attack and defense integrated response engine, break through the limitation of single data type, and fuse multi-modal data such as text log, traffic feature, and file hash; use BERT model to extract semantic features of log text, use CNN to extract spatiotemporal features of traffic, and realize multi-modal feature fusion through the cross-attention mechanism of Transformer;

[0146] Transformer generates attention masks for text log features and traffic features respectively: valid feature position mask is 1, and padding position (such as zero padding for insufficient text length, missing values for traffic time sequence) mask is 0, to ensure that the model only pays attention to valid features; cross-modal mask is set to 1 (allowing text and traffic features to interact);

[0147] BERT model configuration: BERT-Base pre-training model (12-layer Transformer, 768-dimensional hidden layer) is adopted, fine-tuned for network log text (such as firewall log, system log), the first 6 layers of parameters are frozen during training, the last 4 layers are fine-tuned, the learning rate is 5e-5, the batch size is 32, and the AdamW optimizer is used;

[0148] Feature dimension alignment: the text log features (BERT output 768 dimensions) and the traffic space-time features (CNN output 512 dimensions) are unified to 640 dimensions through a linear projection layer, the Transformer cross-attention layer takes 640-dimensional features as input, calculates the interaction weight through the query-key-value (QKV) matrix, and realizes the modal fusion;

[0149] (2) Time series feature enhancement: introduce a time series feature enhancement algorithm, use attention mechanism to enhance the time series feature weight for periodic attacks, and prolong the prediction lead time of periodic threats; the fused features not only improve the prediction accuracy, but also provide more rich feature dimensions for the intelligent threat tracing module.

[0150] Among them, the intelligent threat tracing module includes:

[0151] (1) Attack chain restoration: use the multi-dimensional features provided by the cross-modal feature fusion module to realize accurate positioning of the threat source, combine federated learning and graph reasoning technology, use the local attack path graph uploaded by each node, including source IP, attack target, and exploit vulnerability, aggregate the global attack tracing graph through federated GNN to realize cross-node attack chain restoration;

[0152] The tracing graph is stored in JSON format (including node ID, type, attribute, and edge weight); visualization uses force-directed graph (such as based on D3.js), node size maps threat impact, edge thickness maps attack path confidence, supports zooming, node filtering (such as only showing core assets), and path expansion;

[0153] Path conflict processing: when local paths conflict, federated GNN performs weighted voting based on node contribution: let the contribution of node i be , the weighted votes of each candidate IP for the source node IP of the conflict path are calculated (sum( × indicator function = candidate IP), the IP with the highest votes is taken as the source node of the global path, and the conflict node and the original path are marked in the tracing graph;

[0154] (2) Feature attribution analysis: Develop an attribution analysis algorithm to calculate the contribution of each feature to the prediction result based on the SHAP value, and automatically locate the key features of the threat source; the source tracing results provide the edge-cloud collaborative reasoning module with key threat clues, reduce the blindness of reasoning, and improve reasoning efficiency;

[0155] SHAP value threshold setting: Adaptive threshold is adopted: the mean of the absolute values ​​of all feature SHAP values ​​plus 1 standard deviation is taken as the threshold, and features above the threshold are judged as key features; if the number of key features is less than 3, the first 3 are forcibly retained to ensure the sufficiency of traceability clues;

[0156] Large-scale feature SHAP value optimization: K-means clustering is used to cluster 1000+ features (clustered into 50 classes). First, the class-level SHAP value is calculated, and the top 10 classes with the highest contribution are selected. Then, the individual SHAP value is calculated for the features within the class, which reduces the amount of computation while retaining key feature information.

[0157] The formula for calculating the Feature Contribution (SHAP) value is as follows:

[0158]

[0159] Indicates the first The SHAP value of each feature quantifies the contribution of that feature to the threat prediction result (positive values ​​indicate increased threat probability, and negative values ​​indicate decreased threat probability).

[0160] This represents the set of all input features (such as IP address, port number, payload features, etc.).

[0161] F does not contain the first Any subset of features (i.e.) and );

[0162] This indicates the number of features contained in subset S;

[0163] Indicates the total number of features;

[0164] The model only takes a subset of inputs. Predicted output (e.g., threat probability) when there are specific features;

[0165] This formula is used in the "feature attribution analysis algorithm" of the intelligent threat tracing module, by calculating each feature... The key features (such as a specific malicious IP and an abnormal port) that have the greatest impact on threat prediction results are located, accurate clues for attack chain restoration are provided, and the efficiency of cross-node threat tracing is improved.

[0166] The edge-cloud collaborative inference module comprises:

[0167] (1) Hierarchical inference architecture: based on the threat clues locked by the intelligent threat tracing module, an edge node lightweight inference + cloud deep inference architecture is adopted; a pruned lightweight model is deployed on the edge node to realize millisecond-level local threat preliminary screening; high-suspicious samples are uploaded to the cloud for deep inference using a complete model, and real-time performance and accuracy are considered;

[0168] Model synchronization mechanism of the edge node: under normal network, synchronization is performed once every 24 hours (the cloud pushes the distilled model parameters); when the network is interrupted, the edge node locally saves inference logs, and after the connection is restored, the logs are uploaded first (for cloud model updating), and then the latest model is synchronized, and incremental updating is adopted (only the changed parameters are transmitted);

[0169] Edge model pruning standard: all parameters of the basic feature layer and the top 30% core neurons of the domain adaptation layer (based on weight absolute value sorting) are retained, and the neurons with a weight absolute value less than 1e-4 in the domain adaptation layer are pruned; the number of parameters of the pruned model is controlled to be within 40% of the original model, and the memory occupation of the edge node is ensured to be less than or equal to 512 MB;

[0170] High-suspicious sample determination standard: the high-suspicious sample determination threshold is the threat probability output by the edge model ≥ 60%, and any one of the following conditions is met: containing an unobserved feature (such as a new port), and the similarity of matching a known attack mode ≥ 70%; low-suspicious samples (probability < 30%) are directly intercepted locally, and medium-suspicious samples (30%-60%) are recorded locally and summarized to the cloud at regular intervals;

[0171] (2) Knowledge distillation optimization: a model distillation mechanism is designed, the knowledge (such as softmax output probability) of the deep model is distilled to the edge lightweight model, the inference accuracy of the edge model is ensured, and the computing efficiency is greatly improved; the edge-cloud collaborative inference module as the inference terminal of the system converts the achievements of the previous modules into real-time threat judgment, forming a complete prediction closed loop;

[0172] Distillation temperature parameter setting: temperature T = 5, the softmax output of the cloud deep model is scaled by T (i.e. softmax(z / T)), which is used as the supervision signal of the edge lightweight model, so that the edge model learns the probability distribution details of the cloud model, and the learning weights of hard labels (0 / 1) and soft labels (probability distribution) are balanced.

[0173] Fault-tolerant mechanism of abnormal data: the data uploaded by the node needs to be attached with a data check code (MD5), and the cloud verifies it before receiving it; format error data is directly rejected and the node is notified to retransmit; suspected tampered data (check code does not match) is marked as 'untrusted', excluded from this round of training, and the node with continuous 3 times of abnormal data is temporarily frozen its participation right;

[0174] Time synchronization mechanism: all nodes synchronize with the cloud time server through NTP protocol, and the time error is controlled within ±1 second; the log and event timestamp uniformly use UTC time, and the local display time is converted to time zone time to ensure the alignment of cross-node event timing;

[0175] Model version management strategy: the model version naming format is 'V+iteration number+date' (such as V100_20240520), each version saves complete parameters and performance indicators (precision, recall rate); rollback trigger condition: new version precision decreases by ≥5% compared with the last version, or receives abnormal feedback from 3 or more nodes, and when rolling back, automatically enable the historical version parameters stored by the blockchain.

[0176] It should be noted that, in this text, relational terms such as first and second are used only to distinguish one entity or action from another, and do not necessarily require or imply that there is any such actual relationship or order between these entities or actions. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or equipment including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or equipment.

[0177] Although the embodiments of the present application have been shown and described, it can be understood by those skilled in the art that various changes, modifications, replacements and variations can be made to the embodiments without departing from the principles and spirits of the present application, and the scope of the present application is defined by the appended claims and their equivalents.

Claims

1. A distributed cybersecurity threat prediction system based on federated learning, characterized in that: The system includes: Dynamic Federated Learning Scheduling Module: Designs an adaptive scheduling mechanism driven by threat entropy, calculates the threat feature entropy value of nodes, and triggers emergency iteration when the threshold is exceeded; introduces a hierarchical model, including a basic feature layer and a domain adaptation layer, and dynamically allocates weights through an attention mechanism; Federated Transfer Learning Engine: Based on a hierarchical model, it constructs a knowledge graph and uses graph neural networks to map heterogeneous data to a unified space; it uses generative adversarial networks to train a domain discriminator, reducing the model's accuracy decay across scenarios and outputting a unified feature space. Privacy-enhanced aggregation module: It integrates a dual-layer protection mechanism of differential privacy and homomorphic encryption, adds noise before parameter upload, uses full homomorphic encryption for aggregation, introduces a blockchain notarization mechanism, and records node contribution through smart contracts; Integrated attack and defense response engine: Constructs a prediction-defense closed-loop system, automatically converts threat prediction results into defense strategies, and pushes rules to the firewall through standardized interfaces; dynamically deploys customized honeypots based on predicted attack paths; Cross-modal feature fusion module: It fuses multimodal data including text logs and traffic features, uses the BERT model to extract log semantic features, and CNN to extract the spatiotemporal features of traffic. After fusion by Transformer, it uses an attention mechanism to strengthen the weight of temporal features for periodic attacks. Intelligent threat attribution module: Utilizing multi-dimensional features, combined with federated learning and graph reasoning techniques, it aggregates local attack paths to generate a global attribution graph; and uses SHAP values ​​to calculate the contribution of each feature to the prediction results. Edge-Cloud Collaborative Inference Module: Adopts a lightweight inference architecture at the edge nodes + deep inference architecture in the cloud; a model distillation mechanism is designed so that the knowledge of the deep model is distilled from the cloud to the lightweight model at the edge.

2. The distributed network security threat prediction system based on federated learning according to claim 1, characterized in that: The dynamic federated learning scheduling module includes: (1) Adaptive Iteration Mechanism: Design an adaptive scheduling mechanism driven by threat entropy; by calculating the threat feature entropy value of local data of each node in real time, an emergency iteration is triggered when the entropy value exceeds the set threshold; (2) Hierarchical model architecture: A hierarchical sub-model architecture is introduced. The global model includes a basic feature layer and a domain adaptation layer. Different domain nodes only update the parameters of the domain adaptation layer and dynamically allocate the weights of the two layers through the attention mechanism to adapt to the asymmetric data distribution and provide a model foundation for the federated transfer learning engine.

3. The distributed network security threat prediction system based on federated learning according to claim 1, characterized in that: The federated transfer learning engine includes: (1) Cross-domain feature mapping: Based on the hierarchical model constructed by the dynamic federated learning scheduling module, a cross-domain threat feature mapping algorithm is designed. By constructing a threat feature knowledge graph containing attack patterns and vulnerability features, the graph neural network is used to map the heterogeneous data of different nodes to a unified feature space. (2) Domain adaptation optimization: An adversarial domain adaptation module is designed, and a generative adversarial network is used to train the domain discriminator. By minimizing the loss of distribution differences between domains, the accuracy of the model is reduced when it is transferred across scenes. The generated unified feature space provides a consistent feature basis for the subsequent cross-modal feature fusion module.

4. The distributed network security threat prediction system based on federated learning according to claim 1, characterized in that: The privacy-enhanced aggregation module includes: (1) Dual-layer privacy protection: A dual-layer protection mechanism that integrates differential privacy and homomorphic encryption is used. Before uploading the model parameters, Laplacian noise is added to the gradient to meet the differential privacy requirements. Fully homomorphic encryption is used to aggregate and calculate the encrypted parameters. (2) Fair collaboration mechanism: A blockchain notarization mechanism is added, and the parameter hash value of each model update is written into the consortium chain. The node contribution is recorded through smart contracts, which provides support for the secure aggregation and fair collaboration of the global model.

5. The distributed network security threat prediction system based on federated learning according to claim 1, characterized in that: The integrated offensive and defensive response engine includes: (1) Defense strategy transformation: Based on the global model generated by the privacy-enhanced aggregation module, a prediction-defense closed-loop system is constructed; the threat prediction results are automatically converted into defense strategies, and the rules are pushed to the firewall through a standardized interface, thus transforming the prediction capability into actual defense actions; (2) Sample expansion loop: Design a virtual honeypot trapping module. Based on the predicted attack path, dynamically deploy customized honeypots at edge nodes to trap attack samples and automatically update them to the local training set, forming a positive loop of prediction → trapping → sample expansion → model optimization, providing a new data source for the cross-modal feature fusion module.

6. The distributed network security threat prediction system based on federated learning according to claim 1, characterized in that: The cross-modal feature fusion module includes: (1) Multimodal data processing: Multimodal data including text logs, traffic features and file hashes are fused. The semantic features of log text are extracted using the BERT model, the spatiotemporal features of traffic are extracted using CNN, and the multimodal feature fusion is achieved through the cross-attention mechanism of Transformer. (2) Temporal feature enhancement: A temporal feature enhancement algorithm is introduced to strengthen the temporal feature weights for periodic attacks using an attention mechanism, thereby extending the prediction lead time of periodic threats and providing feature data for the intelligent threat tracing module.

7. The distributed network security threat prediction system based on federated learning according to claim 1, characterized in that: The intelligent threat tracing module includes: (1) Attack chain reconstruction: The multi-dimensional features provided by the cross-modal feature fusion module are used to locate the source of the threat; combined with federated learning and graph reasoning technology, the local attack path graphs uploaded by each node are aggregated by federated GNN to generate a global attack source map; (2) Feature attribution analysis: The attribution analysis algorithm is introduced to calculate the contribution of each feature to the prediction result based on the SHAP value, and the key features of the threat source are automatically located; the source tracing results provide threat clues for the edge-cloud collaborative reasoning module.

8. The distributed network security threat prediction system based on federated learning according to claim 1, characterized in that: The edge-cloud collaborative inference module includes: (1) Layered reasoning architecture: Based on the threat clues locked by the intelligent threat tracing module, a lightweight reasoning architecture with edge nodes and deep reasoning in the cloud is adopted; the edge nodes deploy pruned lightweight models, upload suspicious samples to the cloud, and use the complete model for deep reasoning. (2) Knowledge distillation optimization: Design a model distillation mechanism to distill the knowledge of the deep model to the edge lightweight model in the cloud, thereby improving the computational efficiency while ensuring the inference accuracy of the edge model.

Images