Network security linkage response system based on distributed intrusion detection

Abstract

The invention discloses a network security linkage response system based on distributed intrusion detection, which belongs to the technical field of network security, aims to improve the comprehensiveness of network threat detection and the timeliness of response, and comprises a distributed lightweight probe, an edge preprocessing and initial judgment module, a central depth analysis module, an intelligent linkage response module and a unified management visualization module. The distributed lightweight probe module collects network security data of each network node; the edge preprocessing and initial judgment module processes the network security data and reports the network security data after initial abnormal detection; the central deep analysis module fuses and associates the reported preprocessed data, and obtains a threat analysis result in combination with AI model analysis, external threat intelligence comparison and attack chain reduction; the intelligent linkage response module matches a preset strategy execution scheme based on the threat analysis result and feeds back an effect; and the unified management visualization module is responsible for configuration management, result display and alarm. According to the invention, accurate identification and rapid linkage response of network threats are realized, and the network security is effectively guaranteed.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a network security linkage response system based on distributed intrusion detection. BACKGROUND

[0002] With the evolution of network architecture to distributed multi-node, network security threats present the characteristics of cross-node cooperation and attack chain concealment, and the traditional scheme has been difficult to adapt. Existing intrusion detection relies on single-point devices, only collects local network security data, cannot cover multi-node scenarios, and data is transmitted without preset whitelist filtering and JSON format preprocessing, which not only occupies bandwidth but also reduces analysis efficiency, and preliminary threat detection only relies on rule library matching known features, lacks local behavior baseline judgment of abnormality based on node historical data, and has high unknown threat detection rate.

[0003] In addition, the existing central analysis does not effectively fuse multi-node data, and also combines AI model and external threat intelligence, which is difficult to accurately identify threat types, locate attack sources and restore attack chain stages; the linkage response strategy is not associated with threat types and attack chain stages, the response action has no priority, and the device lacks a standardized interface linkage; the management level has no unified visualization platform, the alarm is not classified according to the attack chain, and the administrator is difficult to master the overall state. Therefore, the existing network security system has the technical defects of incomplete detection coverage, low analysis accuracy, poor response timeliness and scattered management, and an urgent need for a network security solution that can realize distributed detection, deep analysis, intelligent linkage response and unified management. SUMMARY

[0004] The present application aims to provide a network security linkage response system based on distributed intrusion detection to solve the problems raised in the background art.

[0005] To solve the above technical problems, the present application provides the following technical solutions: A network security linkage response system based on distributed intrusion detection, comprising a distributed lightweight probe module, an edge preprocessing and preliminary judgment module, a central deep analysis module, an intelligent linkage response module and a unified management visualization module; The distributed lightweight probe module collects network security data of each network node through probes deployed on each network node; The edge preprocessing and preliminary judgment module filters and formats the network security data of each network node to generate preprocessing data, and performs preliminary threat detection on the preprocessing data of each network node based on a preset rule library and a local behavior baseline, and if the result of preliminary threat detection is abnormal, it is reported to the central deep analysis module; The central deep analysis module receives the preprocessing data of n network nodes reported, After the pre-processing data of the n network nodes are fused and associated, deep threat detection is performed in combination with AI model analysis, external threat intelligence comparison and attack chain restoration technology to obtain threat analysis results; The intelligent linkage response module matches a preset response strategy based on the danger analysis results, obtains a linkage response scheme and executes the same, while feeding back an execution effect after execution of the linkage response scheme to the unified management visualization module; The unified management visualization module performs configuration management on the distributed lightweight probe module, the edge pre-processing and preliminary judgment module, the central deep analysis module and the intelligent linkage response module, displays threat analysis results and execution effects in real time, and provides an alarm notification function.

[0006] Preferably, the probe is deployed in one of a hardware micro-probe and a software plug-in in the network node, wherein the hardware micro-probe is adapted to a gateway device without built-in software deployment conditions, and the software plug-in can be installed in a mainstream operating system of a terminal device, a gateway device and a cloud server; the network node includes a terminal device, a gateway device and a cloud server, and the types of network security data obtained by each network node are different, the terminal device obtains terminal process logs and file modification logs, the gateway device obtains network traffic key fields, and the cloud server obtains application access logs and network traffic key fields; the network security data includes at least one of network traffic key fields, terminal process logs, file modification logs and application access logs, wherein the network traffic key fields include source IP addresses, destination IP addresses, transmission port numbers and communication protocol types, the terminal process logs include process names, process startup times and process permission change records, the file modification logs include file modification paths, file hash values and file modification time stamps, and the application access logs include application request methods, access URLs and database operation statements.

[0007] Preferably, the filtering processing filters and screens the network security data through a preset white list, the preset white list contains trusted IP addresses, normal business process names, conventional application port numbers and operating system default legal file modification paths, and the preset white list can be updated regularly through the unified management visualization module, and the source IP addresses, destination IP addresses, process names, transmission port numbers and file modification paths in the network security data are accurately matched with the preset white list during the filtering and screening, and the network security data completely matched with no threats is directly screened out; the formatting processing converts the network security data after the filtering processing into JSON format pre-processing data, the JSON format pre-processing data contains collection time, network node ID, data type label and core field value, wherein the data type label is used to identify the type of the network security data, i.e., to identify network traffic key fields, terminal process logs, file modification logs and application access logs, and the core field value is the network security data corresponding to the data type label.

[0008] Preferably, the preset rule base comprises malicious features corresponding to each data type label, wherein the network traffic key field label corresponds to a combination of malicious IP address segments, high-risk attack ports and abnormal communication protocols, the terminal process log label corresponds to known malicious process names and unauthorized process privilege escalation records, the file modification log label corresponds to unauthorized modification paths of system sensitive directories and malicious file hash values, and the application access log label corresponds to illegal application request methods, access URLs containing SQL injection or cross-site scripting features, and abnormal database operation statements; the local behavior baseline is a normal behavior threshold value established based on the historical normal preprocessed data of each network node for 7-14 consecutive days, including network connection times per unit time, process startup frequency threshold, file modification times threshold and application access request frequency threshold, and the unit time is set to 1 hour, and can be configured differently according to network node types through a unified management visualization module; In the preliminary threat detection, the core field values of the preprocessed data are first accurately matched with the corresponding malicious features in the preset rule base. If the matching is successful, it is determined that the result of the preliminary threat detection is abnormal. If the matching is not successful, the number of network connections, the number of process startups, the number of file modifications and the number of application access requests per unit time are counted based on the core field values, wherein the number of network connections is derived from the connection records associated with the same source IP address, destination IP address and transmission port number within a unit time, the number of process startups is derived from the number of process startup times of the same process name within a unit time, the number of file modifications is derived from the number of file modification time stamps within a unit time, and the number of application access requests is derived from the number of the same application request methods within a unit time. Accordingly, the corresponding normal behavior threshold value is compared. If the normal behavior threshold value is exceeded by more than 110%, it is determined that the result of the preliminary threat detection is abnormal.

[0009] Preferably, the method steps of the deep threat detection are: S1. Fusion association: based on the core field values in the preprocessed data of n (n≥1) network nodes, attack entities are extracted, and the behavior records of the same attack entity at different network nodes are associated through collection time and network node ID. The association relationship between the attack entity, the behavior and the network node is stored in a graph database to form an associated data set containing the attack entity, the behavior sequence and the network node. The attack entity includes a source IP address extracted from the network traffic key field, a process name extracted from the terminal process log, a malicious file hash value extracted from the file modification log, and an abnormal login account extracted from the application access log, wherein the abnormal login account is obtained by analyzing the database operation statements corresponding to the login interface POST request; S2.AI Model Analysis: The behavioral sequences in the associated dataset are used as input to a pre-trained Temporal Convolutional Network (TCN). The TCN is trained and optimized using a historical attack behavior sequence dataset and outputs the threat types of the associated dataset. The threat types include, but are not limited to, distributed port scanning, cross-node ransomware infection, multi-node collaborative SQL injection, and cross-node lateral penetration. S3. External Threat Intelligence Comparison: Extract attack entities from the associated dataset and call the API of the third-party threat intelligence database to verify whether the attack entity is a malicious entity. If the attack entity is a malicious entity, supplement the attack source information of the attack entity. The attack source information includes geographical location, affiliated organization and historical attack records. Otherwise, mark the attack entity as an unknown malicious entity and record its behavioral characteristics for subsequent manual tracing of the unknown malicious entity and its behavioral characteristics and reporting to the third-party threat intelligence database. S4. Attack Chain Reconstruction Technology: Based on the time sequence relationship of the collection timestamps in the associated dataset, and referring to the MITREATT&CK framework to connect the attack behaviors of the attacking entity, the attack chain stage is determined. The attack chain stage includes initial access, permission probing, lateral movement and data theft. S5. Threat Analysis Results: Threat analysis results are obtained by integrating threat types, attack source information, attack chain stages, and network nodes involved in related datasets.

[0010] Preferably, the preset response strategy is a set of mapping relationships between threat type, attack chain stage and linkage response scheme. This set of mapping relationships is stored in the intelligent linkage response module in the form of an editable configuration file, which can be modified online through the unified management visualization module. Each mapping relationship uniquely corresponds to a linkage response scheme. Under the same threat type, the attack chain stages are prioritized in the order of initial access < permission detection < lateral movement < data theft. The later the stage, the higher the priority of the corresponding linkage response scheme. When executing, the linkage response scheme corresponding to the threat analysis result is called first.

[0011] Preferably, the coordinated response scheme is executed by calling the security components of the network nodes involved in the threat analysis results through a standardized interface RESTful API or SNMP protocol interface. The security components are specifically the EDR protection software of the terminal device, the firewall controller of the gateway device, and the security group module of the cloud server. The execution effect includes the completion status of the coordinated response scheme (execution successful and failed), the containment status of the attack entity behavior (attack not contained and attack contained), and the status changes of the involved network nodes (isolated, normal, and pending recovery). When the attack entity behavior containment status is attack not contained, a supplementary scheme is automatically generated and executed by matching a higher priority coordinated response scheme under the same threat type. The execution effect of the supplementary scheme is synchronously fed back to the unified management visualization module.

[0012] Preferably, the configuration management includes: configuring the probe's collection cycle, data type tag collection range, and resource consumption threshold for the distributed lightweight probe module, wherein the collection cycle can be set to 1-5 minutes, and the resource consumption threshold limits the probe's CPU usage to ≤5% and memory usage to ≤100MB during operation; updating the preset whitelist for the edge preprocessing and initial judgment module, adding or deleting malicious features in the preset rule base, and adjusting the threshold for the local behavior baseline, wherein the preset whitelist update adopts an incremental update method, only synchronously adding or deleting trusted IP addresses, normal business process names, regular application port numbers, and operating system default legal file modification paths. When adding or deleting malicious features in the preset rule base, MD5 verification is used to ensure feature integrity and prevent tampering. The threshold for adjusting the local behavior baseline is set differently according to the node type of terminal device, gateway device, and cloud server. The central deep analysis module performs AI model iteration and configures the synchronization frequency of the third-party threat intelligence database. The AI ​​model iteration supports AI model version management and can be rolled back to a historical stable version after iteration. The synchronization frequency of the third-party threat intelligence database can be set from 1 to 24 hours and is obtained by incremental pull. The preset response strategy of the intelligent linkage response module is adjusted, that is, the linkage response scheme corresponding to the threat type and attack chain stage.

[0013] Preferably, the presentation of threat analysis results and execution effects includes: statistical charts categorized by threat type, a heat map showing the geographical distribution of attack source information, a topological relationship diagram involving network nodes, a time-series progress bar for attack chain stages, and dynamic indicators of execution effects; the alarm notification function classifies alarm levels based on the attack chain stages in the threat analysis results and triggers differentiated alarm notifications according to the alarm level: the initial access stage corresponds to a low-level alarm, with alarm information only displayed in a pop-up window of the unified management visualization module; the permission detection stage corresponds to a medium-level alarm, with alarm information displayed in a pop-up window of the unified management visualization module and sent to the administrator's email address; the lateral movement and data theft stage corresponds to a high-level alarm, with alarm information displayed in a pop-up window of the unified management visualization module, sent to the administrator's email address, and sent to the administrator's mobile phone via SMS, and all alarm information is retained for 6 months for traceability.

[0014] Due to the adoption of the above technical solution, the technical progress achieved by this invention compared to the prior art is as follows: 1. Breaking through the limitations of traditional single-point device acquisition, achieving collaborative distributed data acquisition and efficient edge preprocessing: This invention deploys distributed lightweight probes in the form of hardware micro probes or software plug-ins on all types of network nodes, including terminal devices, gateway devices, and cloud servers, to comprehensively cover multi-node network security data. At the same time, the edge preprocessing and preliminary judgment module filters trusted data through a preset whitelist and formats the filtered data into JSON standard preprocessed data. This not only solves the problem of incomplete coverage in traditional single-point acquisition but also eliminates invalid data and reduces transmission bandwidth consumption, laying an efficient data foundation for subsequent detection.

[0015] 2. Construct a two-dimensional preliminary threat detection mechanism based on a preset rule base and a local behavior baseline to reduce the false negative rate of unknown threats: Traditional detection relies solely on the rule base to identify known threats. This invention, on the other hand, combines a local behavior baseline established based on 7-14 days of historical normal data from each node. Through a two-dimensional judgment that matches core field values ​​with malicious features in the rule base and compares the statistical values ​​of core fields with the baseline threshold of 110%, the comprehensiveness of preliminary threat detection is greatly improved, effectively solving the problem of high false negative rates for unknown threats in traditional solutions.

[0016] 3. Establish a priority-linked and standardized intelligent response mechanism to improve the timeliness and device compatibility of threat handling: This invention designs the preset response strategy as a mapping relationship between threat type, attack chain stage and response plan. Under the same threat type, the response priority is set progressively according to the attack chain stage to ensure that high-risk stages are handled first. At the same time, through RESTful API or SNMP standardized interface, security components are called uniformly, and when the attack is not contained, a higher-level plan is automatically matched to execute supplementary response, solving the problems of disordered response and difficulty in device linkage in traditional methods, and significantly improving the efficiency of threat handling. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0018] Figure 1 This is a schematic diagram of the system functional modules of the present invention. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] Examples, such as Figure 1 The aforementioned network security linkage response system based on distributed intrusion detection includes a distributed lightweight probe module, an edge preprocessing and initial judgment module, a central deep analysis module, an intelligent linkage response module, and a unified management visualization module.

[0021] The distributed lightweight probe module collects network security data from each network node by deploying probes on each network node. The edge preprocessing and preliminary judgment module filters and formats the network security data of each network node to generate preprocessed data, and performs preliminary threat detection on the preprocessed data of each network node based on a preset rule base and local behavior baseline. If the result of the preliminary threat detection is abnormal, it is reported to the central deep analysis module. The central deep analysis module receives preprocessed data reported from n network nodes. After fusing and correlating the preprocessed data from n network nodes, deep threat detection is performed by combining AI model analysis, external threat intelligence comparison, and attack chain reconstruction techniques to obtain threat analysis results. The intelligent linkage response module matches the preset response strategy with the hazard analysis results, obtains the linkage response plan and executes it, and at the same time feeds back the execution effect of the linkage response plan to the unified management visualization module. The unified management visualization module configures and manages the distributed lightweight probe module, edge preprocessing and initial judgment module, central deep analysis module, and intelligent linkage response module, displays threat analysis results and execution effects in real time, and provides alarm notification functions.

[0022] Furthermore, the working principle of the present invention will be illustrated below through embodiments: This embodiment uses a distributed network environment of a medium-sized enterprise as the application scenario. This distributed network environment includes 50 terminal devices, 2 gateway devices, and 3 cloud servers. The distributed lightweight probe module deploys probes differently according to node type: for gateway devices without built-in software deployment conditions, hardware miniature probes are deployed to collect key network traffic fields (including source IP address, destination IP address, transmission port number, and communication protocol type); for terminal devices with Windows or Linux CentOS systems and cloud servers with Linux Ubuntu systems, probes are installed in the form of software plug-ins. Terminal devices collect terminal process logs (including process name, process start time, and process permission change records) and file modification logs (including file modification path, file hash value, and file modification timestamp), while cloud servers collect key network traffic fields and application access logs (including application request methods, access URLs, and database operation statements), realizing comprehensive collection of network security data across all nodes.

[0023] The edge preprocessing and initial judgment module first performs filtering on the network security data collected from each network node: it calls a preset whitelist containing trusted IP addresses (such as the enterprise intranet segment 10.0.0.0 / 24), normal business process names (such as Office.exe), common application port numbers (such as 80, 443), and default legal file modification paths of the operating system (such as C:\Users\Public\), precisely matches the network security data with the preset whitelist, filters out non-threatening network security data, and converts the remaining network security data into JSON format preprocessed data containing collection time, network node ID, data type tags, and core field values; then... Preliminary threat detection is performed on a preset rule base and a local behavior baseline. The preset rule base configures malicious features for tags of various data types (such as malware.exe in terminal process logs and high-risk port 4444 in network traffic). If the core field value matches successfully, the result of the preliminary threat detection is determined to be abnormal. If no match is found, the number of network connections and process startups per unit time per hour is counted and compared with the normal behavior threshold of the local behavior baseline, which is established based on 7-14 days of historical data of nodes and configured differently according to node type. If the value exceeds 110% of the normal behavior threshold, the result of the preliminary threat detection is determined to be abnormal. All abnormal preprocessed data is reported to the central deep analysis module.

[0024] After receiving preprocessed data from network nodes such as Terminal-012, Gateway-02, and ECS-01, the central deep analysis module first extracts the attack entity from core field values, such as the source IP 192.168.1.100, the malicious process name malware.exe, and the access URL http: / / ecs01 / api / login. It then collects behavioral records associated with the same attack entity based on the collection time 2024-10-29T09:25-09:30Z and network node IDs, storing these relationships in a graph database to form a related dataset. Next, the behavioral sequences are input into a pre-trained temporal convolutional network (TCN) optimized using historical attack behavior datasets, outputting the threat type as cross-node ransomware infection. Simultaneously, it calls the Microstep online third-party threat intelligence database API to verify the attack entity, confirming that the source IP 192.168.1.100 is a botnet node and supplementing the attack source information (geographical location: XX region, affiliated organization: XX malicious group, historical attack records). Finally, the behavioral sequences are sorted based on the collection timestamp, referencing MITRE... The ATT&CK framework identifies the attack chain stage as lateral movement based on the chained attack behavior; ultimately, it integrates threat type, attack source information, attack chain stage, and involved network nodes to generate threat analysis results.

[0025] The intelligent linkage response module invokes preset response policies stored in an editable JSON configuration file. These preset response policies map threat types, attack chain stages, and linkage response schemes. Under the same threat type, priorities are set according to the attack chain stages (initial access < permission detection < lateral movement < data theft). For the combination of cross-node ransomware infection and lateral movement, it matches and invokes linkage response schemes from the endpoint EDR protection software, gateway firewall controller, and cloud server security group module. It calls the Terminal-012 EDR software via RESTful API to terminate the malware.exe process, calls the ECS-01 security group to restrict access to the / api / login interface from non-internal IPs, and calls the Gateway-02 firewall controller via SNMP protocol interface to add 192.168.1.100 to the blacklist to block traffic. After execution, the module provides feedback on the execution effect. If the attack entity's behavior is contained (attack traffic reduced by 95%), the node status is confirmed to have returned to normal. If it is not contained, it automatically matches a higher-priority scheme under the same threat type and executes supplementary responses, such as forced endpoint restart and full node virus scanning. The execution effect is synchronously fed back to the unified management visualization module.

[0026] The unified management visualization module enables system-wide configuration management, result display, and alarm notification. In terms of configuration management, a 3-minute collection cycle and resource usage thresholds of CPU ≤ 5% and memory ≤ 100MB are set for the distributed lightweight probe module. For the edge preprocessing and initial judgment module, incremental updates to the preset whitelist and additions / deletions of malicious features in the preset rule base are performed, specifically adding a trusted IP address (10.0.0.20) and adding ransomware.exe with MD5 verification. For the central deep analysis module, AI model iteration versions and a 6-hour incremental synchronization frequency with the third-party threat intelligence database are set. For the intelligent linkage response module, preset response strategies can be adjusted by dragging and dropping. In terms of result display, a bar chart presents the percentage of threat types over the past 24 hours. For example, cross-node ransomware infections account for 35%. High-frequency attack sources are marked with a geographical heatmap (e.g., region XX is highlighted in red), and attack paths are marked with topology association icons (e.g., connecting Gateway-02→Terminal-012→ECS-01 with a dotted line). The attack chain is marked with a timeline progress bar, indicating the time of each stage, and a green checkmark indicates a successful response. In terms of alarm notifications, high-level alarms are classified according to the horizontal movement of the attack chain stages, triggering pop-up prompts in the visualization module (including threat type and node ID), emails to the administrator (with attack source information), and SMS messages to the administrator (including emergency suggestions). All alarm information is retained for 6 months for traceability, achieving comprehensive prevention and unified management of enterprise network threats.

[0027] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A network security linkage response system based on distributed intrusion detection, characterized in that, include: A distributed lightweight probe module is used to collect network security data from each network node by deploying probes on each network node. The edge preprocessing and initial judgment module is used to filter and format the network security data of each network node to generate preprocessed data, and to perform preliminary threat detection on the preprocessed data of each network node based on the preset rule base and local behavior baseline. If the result of the preliminary threat detection is abnormal, it is reported to the central deep analysis module. The central deep analysis module is used to receive preprocessed data from n network nodes, fuse and correlate the preprocessed data from n network nodes, and then perform deep threat detection by combining AI model analysis, external threat intelligence comparison and attack chain reconstruction technology to obtain threat analysis results. The intelligent linkage response module is used to match preset response strategies based on hazard analysis results, obtain linkage response plans and execute them, and at the same time, feed back the execution effect of the linkage response plan to the unified management visualization module. The unified management visualization module is used to configure and manage the distributed lightweight probe module, edge preprocessing and initial judgment module, central deep analysis module, and intelligent linkage response module. It displays threat analysis results and execution effects in real time and provides alarm notification functions.

2. The network security linkage response system based on distributed intrusion detection according to claim 1, characterized in that, The probe is deployed on network nodes in the form of either a hardware micro probe or a software plugin. The network nodes include terminal devices, gateway devices, and cloud servers. The network security data includes at least one of network traffic key fields, terminal process logs, file modification logs, and application access logs.

3. The network security linkage response system based on distributed intrusion detection according to claim 2, characterized in that, The filtering process filters and selects network security data through a preset whitelist, which includes trusted IP addresses, normal business process names, common application port numbers, and default legal file modification paths of the operating system. The formatting process involves converting the filtered cybersecurity data into preprocessed data in JSON format, which includes the collection time, network node ID, data type label, and core field values.

4. The network security linkage response system based on distributed intrusion detection according to claim 3, characterized in that, The preset rule base contains malicious features of tags for various data types, and the local behavior baseline is a normal behavior threshold established based on the historical normal preprocessed data of each network node, including the threshold for the number of network connections per unit time, the threshold for the process start frequency, the threshold for the number of file modifications, and the threshold for the application access request frequency. During the initial threat detection, the core field values ​​of the preprocessed data are matched with the malicious features of the corresponding data type tags in the preset rule base. If the match is successful, the result of the initial threat detection is determined to be abnormal. If no match is found, the core field value is compared with the normal behavior threshold of the local behavior baseline. If it exceeds the normal behavior threshold by more than 110%, the preliminary threat detection result is determined to be abnormal.

5. The network security linkage response system based on distributed intrusion detection according to claim 4, characterized in that, The steps of the deep threat detection method are as follows: S1. Fusion and Association: Based on the core field values ​​of preprocessed data from n (n≥1) network nodes, the attack entity is extracted, and the behavior records of the same attack entity on different network nodes are associated by the collection time and network node ID to form an associated dataset containing the attack entity, behavior sequence and involved network nodes. S2. AI Model Analysis: Using behavioral sequences from the associated dataset as input to a pre-trained temporal convolutional network, the output is the threat type of the associated dataset; S3. External Threat Intelligence Comparison: Extract attack entities from the associated dataset and call the API of the third-party threat intelligence database to verify whether the attack entity is a malicious entity. If the attack entity is a malicious entity, supplement the attack source information of the attack entity; otherwise, mark the attack entity as an unknown malicious entity. S4. Attack Chain Reconstruction Technique: Based on the temporal relationship in the associated dataset, and referring to the MITREATT&CK framework to connect the attack behaviors of the attacking entity, the attack chain stages are determined. The attack chain stages include initial access, permission probing, lateral movement, and data theft. S5. Threat Analysis Results: Threat analysis results are obtained by integrating threat types, attack source information, attack chain stages, and network nodes involved in related datasets.

6. The network security linkage response system based on distributed intrusion detection according to claim 5, characterized in that, The preset response strategy is a set of mapping relationships between threat type, attack chain stage and coordinated response scheme. Each mapping relationship corresponds to a coordinated response scheme, and for the same threat type, the priority of the coordinated response scheme corresponding to different attack chain stages increases as the attack chain stage progresses.

7. The network security linkage response system based on distributed intrusion detection according to claim 6, characterized in that, The coordinated response plan is executed by calling the security components of the network nodes involved in the threat analysis results through a standardized interface. The execution effect includes the completion status of the coordinated response plan, the containment status of the attack entity's behavior, and the status changes of the network nodes involved. When the containment status of the attack entity's behavior is that the attack has not been contained, a supplementary plan is automatically generated and executed by matching a coordinated response plan with a higher priority under the same threat type.

8. The network security linkage response system based on distributed intrusion detection according to claim 1, characterized in that, The configuration management includes: configuring the probe collection cycle, data type label collection range, and resource consumption threshold for the distributed lightweight probe module; updating the preset whitelist, adding or deleting malicious features in the preset rule base, and adjusting the threshold of the local behavior baseline for the edge preprocessing and initial judgment module; iterating the AI ​​model and configuring the synchronization frequency of the third-party threat intelligence database for the central deep analysis module; and adjusting the preset response strategy for the intelligent linkage response module.

9. The network security linkage response system based on distributed intrusion detection according to claim 1, characterized in that, The presentation of threat analysis results and execution effects includes: statistical charts categorized by threat type, a heat map showing the geographical distribution of attack source information, a topological relationship diagram involving network nodes, a time-series progress bar for attack chain stages, and dynamic indicators of execution effects; the alarm notification function classifies alarm levels based on the attack chain stages in the threat analysis results and triggers differentiated alarm notifications according to the alarm level, where the initial access stage corresponds to a low-level alarm, the permission probing stage corresponds to a medium-level alarm, and the lateral movement and data theft stage corresponds to a high-level alarm.

Images