Network threat detection method and system fused with multi-modal analysis

Abstract

The invention relates to the technical field of network threat detection, in particular to a multi-modal analysis-fused network threat detection method and system, which are used for continuously acquiring network traffic, system call logs and cross-domain access records in a cloud computing environment in the power industry. Combining the obtained heterogeneous information into a uniform data stream according to a timestamp and an event identifier; aiming at the formed data stream, carrying out feature expansion on the hidden attack signal by utilizing a behavior pattern deconstruction method; recursive aggregation processing is carried out on the multi-source behavior units, causal chain constraints and role sensitive tags are introduced in the aggregation process, and candidate behavior chains capable of representing the attack evolution process are generated; mapping the candidate behavior chain to a virtual topological structure of a cloud computing environment, and predicting a potential penetration channel based on an attack path deduction algorithm; and triggering an adaptive protection strategy according to the predicted interaction result of the potential permeation channel and the candidate behavior chain. According to the invention, the network threat detection accuracy can be improved.

Description

Technical Field

[0001] This invention relates to the field of network threat detection technology, and is a network threat detection method and system that integrates multimodal analysis. Background Technology

[0002] While existing multimodal network threat detection technologies integrate various data sources such as network traffic, system logs, and user behavior, they often overlook the temporal correlation between these data points. This is especially true in cloud computing environments, where attackers can gradually penetrate systems by launching small-scale attacks at different times.

[0003] Traditional multimodal analysis methods may fail to effectively capture these temporally dispersed but overall aggressive behavioral patterns, leading to false negatives or missed detections. For example, in the cloud computing environment of the power industry, attackers might gain initial access by attacking non-core systems in the public cloud and then gradually infiltrate core systems in the private cloud at different times. Because the attack behaviors are dispersed over time, traditional multimodal analysis methods may fail to effectively correlate these behaviors, resulting in untimely attack detection.

[0004] Therefore, it is necessary to design a network threat detection method and system that integrates multimodal analysis to improve the accuracy of network threat detection. Summary of the Invention

[0005] This invention provides a network threat detection method and system that integrates multimodal analysis, overcoming the shortcomings of the prior art. It can effectively solve the problem that existing multimodal network threat detection technologies ignore the temporal correlation between data when processing data, resulting in untimely detection of attacks.

[0006] One of the technical solutions of this invention is achieved through the following measures: a network threat detection method integrating multimodal analysis, comprising the following steps: Continuously acquire network traffic, system call logs, and cross-domain access records in the power industry cloud computing environment, and combine the acquired heterogeneous information into a unified data stream according to timestamps and event identifiers; For the generated data stream, the behavior pattern deconstruction method is used to expand the features of the covert attack signal, and combined with time slice segmentation and cross-node reference, multi-source behavior units containing latency attributes and resource dependencies are generated. Recursive aggregation processing is performed on multi-source behavioral units. Causal chain constraints and role-sensitive labels are introduced during the aggregation process to generate candidate behavioral chains that can characterize the attack evolution process. After the chains are generated, high-risk segments related to the core system are screened. Candidate behavior chains are mapped to the virtual topology of the cloud computing environment, and potential penetration channels, including lateral movement routes and in-depth penetration paths, are predicted based on attack path inference algorithms, thereby dynamically determining potential critical defense boundaries. Based on the interaction results of the predicted potential penetration channels and candidate behavior chains, an adaptive protection strategy is triggered.

[0007] The following are further optimizations and / or improvements to one of the above-mentioned technical solutions: The process of combining the acquired heterogeneous information into a unified data stream based on timestamps and event identifiers can be described as follows: Preprocessing is performed on network traffic data, system logs, and cross-domain access records from different cloud nodes, including time synchronization, format standardization, and unified event identification. The processed heterogeneous information is sorted by timestamp and a continuous event sequence is generated, with node source tags attached. A short-delay estimation method is used to estimate delayed or missing data in a continuous event sequence, and a unified data stream is output.

[0008] The process of using behavioral pattern deconstruction to perform feature deconstruction on covert attack signals can be described as follows: Extract feature vectors for each event record in the data stream, including access type, frequency, resource target, and time interval; Low-intensity anomalous operations similar to historical attack behaviors are identified by pattern decomposition and marked as potential covert attack signals. Potential covert attack signals are segmented according to time slices and cross-node dependencies are added; Perform a consistency check on the segmentation results to generate preliminary behavioral units.

[0009] The process of generating multi-source behavioral units that include latency attributes and resource dependencies can be described as follows: The delay characteristics of the initial behavioral units are calculated according to the time interval between events, and the delay information is embedded in the unit attributes; Based on the system resources and node dependencies involved in the event, a resource dependency network is established, and a resource mapping table is generated for each behavioral unit; By combining latency characteristics and resource mapping tables, multi-source behavioral units are formed, including start node, end node, operation type, and dependency path information.

[0010] The process of performing recursive aggregation on multi-source behavioral units described above can be summarized as follows: Multi-source behavioral units are hierarchically grouped according to time sequence and node association. Within each group, recursive association analysis is used to identify continuous attack operations across nodes, and multiple related units are merged into an aggregate unit. In the recursive aggregation process, role-sensitive tags are introduced to give high attention weight to privileged user behavior and key node operations; Output the aggregation results, including the start and end times, involved nodes, operation sequence, and risk score for each aggregation unit.

[0011] The process of generating candidate behavior chains that can characterize the attack deduction process can be described as follows: Based on the temporal order and causal relationship of the aggregation units, the relevant units are connected into candidate chains according to the attack evolution path; Calculate the potential threat level for each node and operation sequence involved in the candidate chain, and generate chain weights by combining role sensitivity; Redundancy elimination and conflict verification are performed on candidate chains to eliminate unreasonable chains and generate candidate behavior chains.

[0012] The process of mapping candidate behavior chains to the virtual topology of the cloud computing environment can be described as follows: Map the node information in the candidate behavior chain to the virtual machines, containers, and network interfaces in the virtual topology; During the topology mapping process, the upstream and downstream connections and dependency paths of each node in the chain are recorded; The mapping results are validated for consistency, and the complete mapping information of the validated candidate behavior chain in the virtual topology is output, including the start and end nodes, the path traversed, and the node attributes.

[0013] The process of predicting potential penetration channels based on the attack path deduction algorithm described above can be summarized as follows: Path deduction is performed on the mapped candidate behavior chains to calculate lateral movement and in-depth penetration routes; By combining node permission inheritance relationships and access policies, the security control points that attackers bypass can be identified; By associating the predicted potential penetration channels with the risk weights of each chain, dynamic protection boundary recommendations are generated.

[0014] The process of triggering the adaptive protection strategy described above can be as follows: Based on the results of potential penetration channels and candidate behavior chains, dynamically adjust the access control rules for virtual machines and containers; Temporarily freeze or restrict access to resources involving high-risk nodes; Synchronize the policy adjustment results with the multi-domain security monitoring platform and push joint alerts and response instructions; Continuously monitor the implementation effectiveness and update and adjust strategies based on real-time threat intelligence and behavioral chains.

[0015] The second technical solution of the present invention is achieved through the following measures: a network threat detection system integrating multimodal analysis, applied to the above-mentioned network threat detection method integrating multimodal analysis, comprising: The data acquisition module is used to continuously acquire network traffic, system call logs, and cross-domain access records, and integrate them into a unified data stream; The signal deconstruction module is used to perform feature deconstruction on the covert attack signals in the data stream and generate multi-source behavioral units with time delay attributes and dependencies. The link aggregation module is used to perform recursive aggregation on multi-source behavioral units, generate candidate attack behavior chains, and filter high-risk segments. The path deduction module is used to map candidate behavior chains to a virtual topology, predict potential penetration channels, and dynamically determine the defense boundary. The adaptive protection module is used to trigger adaptive protection strategies based on potential penetration channels and candidate behavior chain results.

[0016] Compared with existing technologies, this invention has the following advantages: By unifying heterogeneous data into a continuous data stream along the time axis and refining the deconstruction of covert attack signals, this invention can significantly improve the early detection capability of low-intensity, decentralized penetration behaviors, thereby effectively reducing the risk of delayed detection and increased losses; by adopting a hierarchical abstraction mechanism of multi-source behavioral units and recursive aggregation, it can suppress false alarms caused by noise and ordinary business activities while maintaining high sensitivity, thus improving detection accuracy and availability; by mapping candidate behavioral chains to real-time virtual topology and combining them with attack path deduction, it can not only provide probabilistic predictions of potential lateral movement and deep penetration channels, but also identify easily bypassed security control points, providing an executable chain of evidence and priorities for protection decisions. Based on the inference results, the adaptive protection strategy enables real-time adjustment and cross-domain collaborative linkage of virtual machine access control and resource access permissions. It can quickly curb the spread of attacks without interrupting critical business operations, and is easy to integrate with existing SOC, SOAR and multi-domain monitoring platforms, supporting both automated response and manual review. By recording mapping evidence, chain verification logs and policy adjustment history, it enhances the ability to trace the source and collect evidence, which is beneficial for post-event analysis and compliance auditing. It takes into account the accuracy of detection, timeliness of response, business availability and operational auditability, and is particularly suitable for real-time protection of critical assets in the hybrid cloud environment of the power industry. It can significantly shorten the threat dwell time, reduce the overall loss of security incidents and optimize the allocation of security operation and maintenance resources. Attached Figure Description

[0017] Appendix Figure 1 This is a flowchart illustrating the network threat detection method that integrates multimodal analysis according to an embodiment of the present invention.

[0018] Appendix Figure 2This is a schematic diagram of the network threat detection system that integrates multimodal analysis according to an embodiment of the present invention. Detailed Implementation

[0019] The present invention is not limited to the following embodiments, and the specific implementation can be determined according to the technical solution of the present invention and the actual situation.

[0020] The present invention will be further described below with reference to embodiments: Example 1: Please refer to Figure 1 As shown in the embodiment of the present invention, a network threat detection method integrating multimodal analysis includes the following steps: Step S1: Continuously acquire network traffic, system call logs, and cross-domain access records in the power industry cloud computing environment, and combine the acquired heterogeneous information into a unified data stream according to timestamps and event identifiers.

[0021] The process of combining the acquired heterogeneous information into a unified data stream according to timestamps and event identifiers in step S1 is as follows: Network traffic data, system logs, and cross-domain access records from different cloud nodes are preprocessed, including time synchronization, format standardization, and unified event identification. Network traffic data typically originates from different virtual machine network cards, container interfaces, and switch nodes. System logs consist of operating system kernel calls, application process running information, and resource scheduling records. Cross-domain access records cover user authentication requests, interface call traces, and data transmission credentials. Due to discrepancies in the collection frequency and time base of different nodes, time synchronization is performed using global clock calibration and local time correction methods to ensure the comparability of multi-source data on the same timeline. A unified format standardization process is adopted for all types of data, including field mapping, log structured parsing, and protocol data parsing, thereby eliminating data heterogeneity caused by different collection sources. A unified event identification mechanism is used to assign standardized identifiers to events from different sources. The processed heterogeneous information is sorted by timestamp to generate a continuous event sequence, and node source tags are attached. The preprocessed data entries are globally sorted, using the timestamp field as the primary sorting criterion. When time conflicts occur, secondary sorting is performed using event identifiers and node priorities, thereby generating a strictly continuous event sequence in time. To ensure that events can be traced back to specific physical or virtual nodes in the subsequent behavioral analysis stage, a node source tag is attached to each record. This tag includes node type (virtual machine, container, or gateway), node identifier, and geographical deployment information. In this way, the unified event sequence not only has strict temporal consistency but also accurately reflects the correspondence between events and the computing environment topology in the spatial dimension. For delayed or missing data in a continuous event sequence, a short-latency estimation method is used to output a unified data stream. In cross-node data acquisition, network congestion, log loss, or misalignment of acquisition windows often lead to delays or missing events. After generating the event sequence, a short-latency estimation method is introduced, which estimates and fills in missing segments based on the time interval and behavioral patterns of adjacent events. In case of delay, the event order is corrected by adjusting the sliding window. During the estimation process, historical data statistical characteristics and real-time context constraints can be combined to ensure that the compensated data is consistent with the actual business logic. The resulting unified data stream is a data set that has undergone time sequence integrity correction, node source labeling, and cross-domain event association.

[0022] Step S2: For the formed data stream, use the behavior pattern deconstruction method to expand the features of the covert attack signal, and combine time slice segmentation and cross-node reference to generate multi-source behavior units containing latency attributes and resource dependencies.

[0023] The process of using the behavioral pattern deconstruction method to perform feature expansion on the covert attack signal in step S2 is as follows: For each event record in the data stream, a feature vector is extracted, including access type, frequency, resource target, and time interval. Structured parsing and attribute standardization are performed on each event record in the generated unified data stream, parsing the original fields (source / destination address, port, session ID, process / container identifier, user / subject identifier, operation type, HTTP method or RPC interface name, return code) and mapping these fields to a predefined set of attributes. Statistical features based on the event window are calculated, such as request frequency within a fixed or adaptive window, average session duration, number of concurrent connections to the same subject, number of hits to the same resource, and their distribution. Temporal features are also extracted, including the time interval between the event and the previous related event, the event's location throughout the day (e.g., working / non-working time markers), and latency distribution indicators across nodes. Semantic encoding is performed on the resource target (e.g., mapping files, APIs, and database tables to resource category IDs and assigning resource sensitivity values). After numerical normalization, category encoding, and missing value processing, the above atomic and statistical features are concatenated into a fixed-length feature vector. The vector dimensions and feature lists are clearly marked in the appendix of the specification. Low-intensity anomalous operations similar to historical attack behaviors are identified using pattern decomposition methods and marked as potential covert attack signals. Segmented matching and threshold relaxation strategies are used to identify low-intensity but attack-characteristic operation sequences. Typical behavior templates (using either sequence-based templates or feature aggregation templates) are constructed based on a historical attack sample database, and these templates are normalized to support cross-platform comparison. Multi-criteria similarity measures are applied to real-time feature sequences (e.g., normalized cosine similarity to evaluate vector shape, dynamic time warping to evaluate temporal similarity of time series, and edit distance to evaluate discrete operation sequences). The similarity is calculated by combining the similarity of the sequences and selecting the appropriate combination of metrics according to the scenario to form a comprehensive similarity score. To enhance the sensitivity to gradual penetration behavior, a strategy of relaxing the intensity threshold is introduced in the similarity judgment. When the comprehensive similarity is high but the magnitude of a single action is low, the similarity weight is increased. At the same time, the confidence score is calculated by combining the context (node ​​role, whether it is outside working hours, and whether there are known vulnerability indicators). If the confidence score exceeds the configurable threshold and is not in the whitelist or false alarm rule base, the corresponding sequence is marked as a potential covert attack signal and its start and end time, participating entities, and confidence metadata are recorded. Potential covert attack signals are segmented according to time slices and cross-node dependencies are attached. The marked covert attack signals are then structured and segmented according to time slices and call relationships. Appropriate time slice lengths are selected based on event type and business characteristics (e.g., short slices for high-speed sessions, long slices for slow penetration; the recommended default short slice length is 30 seconds–5 minutes, and long slice length is 10 minutes–2 hours, configurable). Continuous or closely spaced events are further segmented by time slice boundaries. Within each time slice, key event points are identified (e.g., first credential use, abnormal permission changes, cross-host session migration, abnormal data export, etc.), and the relative time offsets of these key points are recorded. A cross-node dependency mapping table is established using session ID, transaction ID, call chain ID, or by matching similar session features. Table entries include dependency type (session delivery, credential reuse, RPC call), source and target node identifiers, and dependency strength estimation (based on call frequency and time tightness). The time slices and their dependency mappings are encapsulated together into a multi-source behavioral unit metadata package. This metadata package includes a time range, key event index, participating node list, dependency table, and preliminary confidence level. Consistency checks are performed on the segmented results to generate preliminary behavioral units. Multidimensional consistency checks are then performed on each time segment and its dependency mapping to ensure the semantic and logical validity of the behavioral units: at the time consistency level, the sequence of key events is verified to meet basic causal relationships (e.g., credential acquisition should precede credential use, session establishment should precede operation); at the dependency consistency level, the paths in the cross-node dependency table are checked to ensure they exist within the current network topology and routing policy (whether calls pass through allowed middleware or gateways); at the semantic consistency level, the event type is checked to ensure it matches the node role (e.g., low-privilege nodes should not initiate high-privilege configuration changes); for any missing or contradictory information (e.g., empty key fields, timestamp conflicts, or broken dependency paths), attempts are made to use adjacent time slice context completion (based on estimation of similar fields from the nearest neighboring unit) or to mark the unit as uncertain and reduce its confidence; segments that pass consistency checks and whose confidence reaches the threshold are encapsulated and written into the behavioral unit pool to form preliminary behavioral units.

[0024] The process of generating multi-source behavioral units containing latency attributes and resource dependencies in step S2 is as follows: The latency characteristics of the initial behavioral units are calculated according to the time interval between events, and the latency information is embedded in the unit attributes. The event sequence arranged in chronological order in the initial behavioral units is obtained, and the difference between the timestamps of adjacent events is calculated to obtain the latency between single events. At the same time, for chained calls containing multiple nodes, the overall cumulative latency and average latency are calculated, and abnormally long or ultra-short latency is marked. In order to improve the comparability of features, the latency information needs to be normalized, for example, the relative latency is calculated with the system's reference clock cycle or standard response time as the denominator. These latency features are embedded into the unit attribute table in vector form, and the latency distribution curve, latency peak position and difference measure between the latency and normal behavior are recorded for each unit. Based on the system resources and node dependencies involved in the event, a resource dependency network is established, and a resource mapping table is generated for each behavioral unit. The event records in the preliminary behavioral unit are parsed to extract the identifiers of the system resources involved, such as file paths, database table names, memory objects, virtual machine interfaces or application APIs. Combined with the source and target nodes associated with the event, resource dependency pairs are established. For example, when a database call event depends on the credential acquisition event in the previous step, a dependency chain of credential resource → database resource is established in the mapping table. These resources and their dependencies are organized into a resource dependency network, where the nodes are resource entities and the edges represent access, call or transmission relationships. A resource mapping table is generated for each behavioral unit, which records the resource entity ID, dependency type, direction attribute and resource sensitivity level, thus fully describing the resource interactions involved in the behavioral unit. By combining latency characteristics and resource mapping tables, multi-source behavioral units are formed, including start node, end node, operation type, and dependency path information. The obtained latency characteristics are fused with the generated resource mapping table to construct a structured multi-source behavioral unit, which not only includes the identification information of the start node and end node, but also the main operation type of the unit (such as read / write operation, authentication request, remote call) and the dependency path derived from the resource dependency network. The dependency path is represented by a set of directed edges, which can reflect the interaction links across nodes and resources, and output the multi-source behavioral unit.

[0025] Step S3: Perform recursive aggregation processing on multi-source behavioral units, introduce causal chain constraints and role-sensitive labels during the aggregation process, generate candidate behavioral chains that can characterize the attack evolution process, and screen high-risk segments related to the core system after the chains are generated.

[0026] The process of performing recursive aggregation on multi-source behavioral units in step S3 is as follows: Multi-source behavioral units are hierarchically grouped according to time sequence and node association. Within each group, recursive association analysis is used to identify continuous attack operations across nodes, and multiple related units are merged into an aggregate unit. Multi-source behavioral units stored in the behavioral unit database are sorted by timestamp and initially clustered according to their respective nodes, resource dependency paths, and call relationships to form several hierarchical groups. Within each group, recursive association analysis is performed: starting from the current unit, units that are temporally adjacent and have dependencies on resources or nodes are retrieved sequentially. If a continuous operation pattern across nodes is found (e.g., authentication request followed by file access, followed by network forwarding), it is identified as a potential attack chain segment. A depth-first recursive search method is used to expand the associatable units layer by layer until no new dependencies can be found. All multi-source behavioral units that meet the conditions in terms of time sequence and node association are merged into an aggregate unit to form a higher level of attack behavior abstraction. In the recursive aggregation process, role-sensitive tags are introduced to assign high attention weights to privileged user behavior and key node operations. During the aggregation analysis, the operator identity and node type involved in each event are analyzed and compared with a predefined role-sensitive tag library. The role-sensitive tag library typically includes privileged users (such as system administrators and database administrators), key resource nodes (such as authentication servers, financial databases, and core switches), and regulated sensitive system modules. Once an operation involving the above-mentioned highly sensitive roles or nodes is detected during the recursive aggregation process, the weight factor of that unit is amplified, increasing its priority in risk calculation and chain splicing. Through this mechanism, abnormal behavior of high-value targets can be highlighted, ensuring that potential advanced persistent threat signals are not masked by frequent ordinary operations. Output the aggregation results, including the start and end times, involved nodes, operation sequence, and risk score for each aggregation unit. After generating the aggregation unit, perform metadata annotation on each aggregation unit, extract the start and end times of the aggregation unit as the position of the unit on the attack evolution timeline, list all involved node sets, label the role category and resource attributes of each node, sort the operation events in the aggregation unit in chronological order to form a complete operation sequence description, calculate the risk score based on the latency characteristics, number of sensitive tags for roles, cross-node jump amplitude, and abnormal operation intensity contained in the unit, and output a quantitative index (such as a risk value between 0 and 1 or high, medium, and low levels).

[0027] The process of generating candidate behavior chains that can characterize the attack deduction process in step S3 is as follows: Based on the temporal order and causal relationship of the aggregation units, related units are connected into candidate chains according to the attack evolution path. Based on the aggregation unit library, a time index is first established according to the start and end times of the aggregation units, and causal labels are maintained for each unit (e.g., credential acquisition → credential use, session migration → data access). When constructing candidate chains, starting from any high-risk aggregation unit, aggregation units within the subsequent time window (configurable window length, e.g., default 30 minutes) are selected as potential subsequent nodes. The existence of causal evidence such as resource dependency, session continuation, or credential reuse between the two units is examined. If such evidence exists, the unit is added to the chain and the chain continues to expand. A breadth-first or depth-first strategy is used to detect possible evolution branches. To control path explosion and avoid excessive combination, an upper limit is set on the expansion depth and the number of branches (e.g., maximum depth 10, maximum number of branches 5). The chain coherence score (based on temporal tightness, resource continuity, and session consistency) is calculated each time a unit is added, and only candidate chains with a coherence score higher than the threshold are retained. For each node and operation sequence involved in the candidate chain, the potential threat level is calculated, and chain weights are generated by combining role sensitivity. For each node in the candidate chain, node attributes (such as node type, role tag, known vulnerabilities, and historical anomaly records) are extracted, and for each operation sequence, operation intensity and anomaly characteristics (such as frequency anomalies, parameter anomalies, and time anomalies) are extracted. Node risk indicators and operation risk indicators are calculated separately. Node risk indicators can be weighted and synthesized from multiple components, such as node importance score (core / boundary / temporary), historical anomaly frequency score, and anomaly measurement of the node in the current event. Operation risk indicators are based on... The operation type sensitivity table and behavior deviation are derived. The risk indicators of each node and operation within the chain are summarized into the chain's basic risk value according to predetermined rules (e.g., using weighted summation or maximum value strategy). A role sensitivity correction factor is introduced: if the chain contains privileged subjects or key resource nodes, the basic risk value is amplified according to the role sensitivity level (e.g., multiplied by an amplification factor of 1.2–2.0, which is configurable). The comprehensive weight of each candidate chain is obtained to reflect the priority of the chain's potential threat to system security. Redundancy elimination and conflict verification are performed on the candidate chains, unreasonable chains are eliminated, and candidate behavior chains are generated.

[0028] Step S4: Map the candidate behavior chain to the virtual topology of the cloud computing environment, and predict potential penetration channels based on the attack path inference algorithm, including lateral movement routes and deep penetration paths, so as to dynamically determine potential critical protection boundaries.

[0029] The process of mapping the candidate behavior chain to the virtual topology of the cloud computing environment in step S4 is as follows: Map the node information in the candidate behavior chain to the virtual machines, containers, and network interfaces in the virtual topology; extract the node identifier set from the candidate behavior chain, and simultaneously retrieve the current virtual topology list and metadata of each resource (such as instance tags, deployment location, network interface identifier, security group, and role tags) from the cloud management platform or virtualization control plane; perform multi-stage matching based on priority rules: first attempt exact matching (such as UUID / Pod UID, complete MAC, session ID); if exact matching fails, use strong correlation matching (such as IP:port and port mapping, process / container image metadata, tag / annotation field matching); if there is still no direct match, use heuristic correlation (such as traffic clustering within the same time window, semantic matching of service name / port, and historical mapping cache backtracking), and record the matching method and evidence for each match; During the topology mapping process, the upstream and downstream connections and dependency paths of each node in the chain are recorded. After completing the mapping from node to topology entity, a set of directed dependency edges is constructed to represent the upstream and downstream connections by analyzing the event sequence and data flow metadata in the candidate chain and the session metadata collected from network monitoring. Each edge records the protocol type, source port, session start and end time, session duration, transmission direction, session identifier, and session confidence, and supplements edge-level statistical features (average round-trip time, retransmission rate, and number of bytes). For cross-node resource dependencies (such as credential transfer, session migration, or RPC chain), a dependency path sequence is generated with dependency type labels and dependency strength estimates. The mapping results are verified for consistency, and the complete mapping information of the verified candidate behavior chain in the virtual topology structure is output, including the start and end nodes, the path traversed, and node attributes.

[0030] The process of predicting potential penetration channels based on the attack path deduction algorithm in step S4 is as follows: The system performs path deduction on the mapped candidate behavior chains, calculating lateral movement and deep penetration routes. Using a validated virtual topology mapping view as input, each candidate behavior chain's nodes and edges are considered as possible starting points or intermediate states, and path deduction is performed based on this. The deduction process is based on a directed weighted graph model: the nodes of the graph correspond to virtual machines, containers, or network interfaces, and the edges represent reachable connections with weights (the weights are composed of the edge's reachability confidence, historical interaction frequency, and transmission latency). The deduction employs a strategy combining probability propagation and heuristic search, utilizing weighted shortest paths to calculate the most economical lateral movement path in terms of time and hop count. Under the premise of satisfying policy constraints, multiple possible deep penetration routes and their probabilities are estimated based on Monte Carlo sampling. The deduction process includes branch pruning rules to control combinatorial explosion (e.g., limiting the maximum path depth to N=12 and the maximum number of candidate paths to M=200), and outputs the path sequence, cumulative transition probability, expected time window, and key weakness points on the path for each deduced path. By combining node permission inheritance relationships and access policies, the system identifies security control points that attackers can bypass. After obtaining several candidate penetration paths, the system performs permission and policy feasibility verification for each hop on the path: it reads the node's permission inheritance structure (including role inheritance, group policies, service account mappings, and temporary privilege escalation rules) and the currently effective access control policies (ACLs, security group rules, network policies, and IAM policies) from the permission model library; it calculates the permission reachability score for each step in the path, which comprehensively considers the matching degree between the permissions required for the operation and the permissions currently held by the node, the existence of a lateral permission delegation chain, and the audit or blocking rules that may be triggered in the path; if the permission reachability of a certain step is not reachable under the normal policy but can be bypassed due to permission inheritance, weak passwords, session credential reuse, or known vulnerabilities, the control point is marked as a potential bypass point in the result, and the bypass method assumptions are recorded (e.g., credential theft, privilege escalation, or abuse of management interfaces). The system calculates the bypass cost estimate for each potential bypass point (quantified based on the required vulnerability exploit complexity, credential availability, and number of induced interactions), and outputs a list of bypass points and corresponding protection recommendations. The predicted potential penetration channels are correlated with the risk weights of each chain to generate dynamic protection boundary recommendations. The obtained candidate penetration paths and their probability distributions are combined with the identified potential bypass points and node-level accessibility scores. The path risk value of each path is calculated according to a predefined risk aggregation function, which is in the form of a weighted sum. After sorting based on the path risk values, dynamic protection boundary recommendations are generated, including but not limited to: temporarily tightening network segmentation policies at the primary cross-point of high-risk paths, immediately issuing patches or forcing credential resets at key bypass points, implementing session isolation or secondary authentication for specific nodes, and configuring path-based intrusion detection rules to enhance monitoring coverage. Each recommendation is accompanied by an implementation priority (high / medium / low), an estimated impact range (a list of affected virtual machines / services), and a recommended action (e.g., blocking ports, modifying ACLs, triggering emergency scripts).

[0031] Step S5: Trigger an adaptive protection strategy based on the interaction results of the predicted potential penetration channels and candidate behavior chains.

[0032] The process of triggering the adaptive protection strategy in step S5 is as follows: Based on the results of potential penetration channels and candidate behavior chains, the access control rules for virtual machines and containers are dynamically adjusted; the potential penetration channels predicted by the attack path inference algorithm are read and aligned with the nodes and operations involved in the candidate behavior chains to identify threatened virtual machine and container resources. Temporary access control adjustment schemes are generated based on the security policy engine, including operations such as modifying virtual LAN policies, adjusting container network policies, dynamically updating firewall policy tables, and resetting security group configurations. For example, when a link shows that an attacker may be able to access a specific database node through lateral movement, the external access port of that node is immediately closed, or only requests from trusted subnets are allowed to continue to access it. Dynamic adjustment can cut off potential penetration paths before the attack is fully launched, thereby improving the proactiveness and targeting of the defense. Temporarily freeze or restrict access to resource calls involving high-risk nodes; based on the risk weight of the candidate behavior chain and the risk value of the penetration channel, identify key nodes in high-risk positions, such as control plane nodes, data storage nodes, or management containers with privileged roles. For these nodes, resource call restriction policies will be triggered, including freezing their access to sensitive APIs, temporarily disabling certain high-risk system calls, restricting the horizontal credential reuse of accounts across multiple nodes, or even directly setting high-risk accounts to read-only or locked status. Such freezing or restriction measures all have time windows (e.g., 30 minutes to 2 hours), and the triggering reason, restriction scope, and expected recovery time are recorded in the background to avoid long-term interference with normal business operations; The policy adjustment results are synchronized with the multi-domain security monitoring platform, pushing joint alerts and response instructions. The executed access control adjustments and resource restriction measures are synchronized to the multi-domain security monitoring platform through standardized interfaces. The synchronized content includes: the specific rules of the adjustment (such as port blocking, account freezing), the effective time and revocation conditions, the list of involved nodes and the expected scope of impact. Joint alert information will be generated, which includes attack path prediction results, candidate behavior chain summaries, risk levels of triggering policies and their associated event numbers, and will be pushed to the security operation and maintenance center, situational awareness platform and automated response orchestration system. Response instructions can trigger the linkage of external devices or systems, such as enabling the blocking mode of the intrusion prevention system, triggering the traffic switching of the load balancer or calling the log audit service to enhance evidence collection. Through this synchronization and push mechanism, multi-party security collaboration and rapid response in cross-domain environments can be guaranteed. The system continuously monitors the implementation effectiveness and updates and adjusts strategies based on real-time threat intelligence and behavioral chains. Monitoring indicators include changes in network traffic, call anomaly rate, fluctuations in the number of alerts, and trends in user behavior patterns. If the activity of the original candidate chains decreases significantly after the implementation of protective measures, it indicates that the strategy is effective. If new abnormal behavior chains appear, they will be automatically cross-validated against real-time threat intelligence sources. If new threat patterns or signs of strategy evasion are found, the existing protection strategy will be adjusted immediately, including extending the freeze period, expanding the restricted scope, or dynamically generating new access control rules. All adjustments are recorded through policy version management for retrospective and auditing purposes, ensuring that the protection strategy is not rigid but continuously evolves with changes in attack patterns and threat intelligence.

[0033] Example 2: As Figure 2 As shown, a network threat detection system integrating multimodal analysis, applied to the aforementioned network threat detection method integrating multimodal analysis, includes: The data acquisition module is used to continuously acquire network traffic, system call logs, and cross-domain access records, and integrate them into a unified data stream; The signal deconstruction module is used to perform feature deconstruction on the covert attack signals in the data stream and generate multi-source behavioral units with time delay attributes and dependencies. The link aggregation module is used to perform recursive aggregation on multi-source behavioral units, generate candidate attack behavior chains, and filter high-risk segments. The path deduction module is used to map candidate behavior chains to a virtual topology, predict potential penetration channels, and dynamically determine the defense boundary. The adaptive protection module is used to trigger adaptive protection strategies based on potential penetration channels and candidate behavior chain results.

[0034] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions, and variations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

[0035] The above technical features constitute the embodiments of the present invention, which have strong adaptability and implementation effect. Unnecessary technical features can be added or removed according to actual needs to meet the needs of different situations.

Claims

1. A network threat detection method integrating multimodal analysis, characterized in that, Includes the following steps: Continuously acquire network traffic, system call logs, and cross-domain access records in the power industry cloud computing environment, and combine the acquired heterogeneous information into a unified data stream according to timestamps and event identifiers; For the generated data stream, the behavior pattern deconstruction method is used to expand the features of the covert attack signal, and combined with time slice segmentation and cross-node reference, multi-source behavior units containing latency attributes and resource dependencies are generated. Recursive aggregation processing is performed on multi-source behavioral units. Causal chain constraints and role-sensitive labels are introduced during the aggregation process to generate candidate behavioral chains that can characterize the attack evolution process. After the chains are generated, high-risk segments related to the core system are screened. Candidate behavior chains are mapped to the virtual topology of the cloud computing environment, and potential penetration channels, including lateral movement routes and in-depth penetration paths, are predicted based on attack path inference algorithms, thereby dynamically determining potential critical defense boundaries. Based on the interaction results of the predicted potential penetration channels and candidate behavior chains, an adaptive protection strategy is triggered.

2. The network threat detection method integrating multimodal analysis according to claim 1, characterized in that, The process of combining the acquired heterogeneous information into a unified data stream according to timestamps and event identifiers is as follows: Preprocessing is performed on network traffic data, system logs, and cross-domain access records from different cloud nodes, including time synchronization, format standardization, and unified event identification. The processed heterogeneous information is sorted by timestamp and a continuous event sequence is generated, with node source tags attached. A short-delay estimation method is used to estimate delayed or missing data in a continuous event sequence, and a unified data stream is output.

3. The network threat detection method integrating multimodal analysis according to claim 2, characterized in that, The process of using behavioral pattern deconstruction to perform feature deconstruction on covert attack signals is as follows: Extract feature vectors for each event record in the data stream, including access type, frequency, resource target, and time interval; Low-intensity anomalous operations similar to historical attack behaviors are identified by pattern decomposition and marked as potential covert attack signals. Potential covert attack signals are segmented according to time slices and cross-node dependencies are added; Perform a consistency check on the segmentation results to generate preliminary behavioral units.

4. The network threat detection method integrating multimodal analysis according to claim 3, characterized in that, The process of generating multi-source behavioral units that include latency attributes and resource dependencies is as follows: The delay characteristics of the initial behavioral units are calculated according to the time interval between events, and the delay information is embedded in the unit attributes; Based on the system resources and node dependencies involved in the event, a resource dependency network is established, and a resource mapping table is generated for each behavioral unit; By combining latency characteristics and resource mapping tables, multi-source behavioral units are formed, including start node, end node, operation type, and dependency path information.

5. The network threat detection method integrating multimodal analysis according to claim 4, characterized in that, The process of performing recursive aggregation on multi-source behavioral units is as follows: Multi-source behavioral units are hierarchically grouped according to time sequence and node association. Within each group, recursive association analysis is used to identify continuous attack operations across nodes, and multiple related units are merged into an aggregate unit. In the recursive aggregation process, role-sensitive tags are introduced to give high attention weight to privileged user behavior and key node operations; Output the aggregation results, including the start and end times, involved nodes, operation sequence, and risk score for each aggregation unit.

6. The network threat detection method integrating multimodal analysis according to claim 5, characterized in that, The process of generating candidate behavior chains that can characterize the attack deduction process is as follows: Based on the temporal order and causal relationship of the aggregation units, the relevant units are connected into candidate chains according to the attack evolution path; Calculate the potential threat level for each node and operation sequence involved in the candidate chain, and generate chain weights by combining role sensitivity; Redundancy elimination and conflict verification are performed on candidate chains to eliminate unreasonable chains and generate candidate behavior chains.

7. The network threat detection method integrating multimodal analysis according to claim 6, characterized in that, The process of mapping candidate behavior chains to the virtual topology of the cloud computing environment is as follows: Map the node information in the candidate behavior chain to the virtual machines, containers, and network interfaces in the virtual topology; During the topology mapping process, the upstream and downstream connections and dependency paths of each node in the chain are recorded; The mapping results are validated for consistency, and the complete mapping information of the validated candidate behavior chain in the virtual topology is output, including the start and end nodes, the path traversed, and the node attributes.

8. The network threat detection method integrating multimodal analysis according to claim 7, characterized in that, The process of predicting potential penetration channels based on attack path deduction algorithms is as follows: Path deduction is performed on the mapped candidate behavior chains to calculate lateral movement and in-depth penetration routes; By combining node permission inheritance relationships and access policies, the security control points that attackers bypass can be identified; By associating the predicted potential penetration channels with the risk weights of each chain, dynamic protection boundary recommendations are generated.

9. A network threat detection method integrating multimodal analysis according to claim 8, characterized in that, The process of triggering the adaptive protection strategy is as follows: Based on the results of potential penetration channels and candidate behavior chains, dynamically adjust the access control rules for virtual machines and containers; Temporarily freeze or restrict access to resources involving high-risk nodes; Synchronize the policy adjustment results with the multi-domain security monitoring platform and push joint alerts and response instructions; Continuously monitor the implementation effectiveness and update and adjust strategies based on real-time threat intelligence and behavioral chains.

10. A network threat detection system integrating multimodal analysis, applied to the network threat detection method integrating multimodal analysis as described in any one of claims 1-9, characterized in that, include: The data acquisition module is used to continuously acquire network traffic, system call logs, and cross-domain access records, and integrate them into a unified data stream; The signal deconstruction module is used to perform feature deconstruction on the covert attack signals in the data stream and generate multi-source behavioral units with time delay attributes and dependencies. The link aggregation module is used to perform recursive aggregation on multi-source behavioral units, generate candidate attack behavior chains, and filter high-risk segments. The path deduction module is used to map candidate behavior chains to a virtual topology, predict potential penetration channels, and dynamically determine the defense boundary. The adaptive protection module is used to trigger adaptive protection strategies based on potential penetration channels and candidate behavior chain results.

Images