Holographic multi-dimensional situation management and control method

Abstract

The invention discloses a holographic multi-dimensional situation management and control method, which relates to the technical field of internet of things intrusion detection, combines edge computing with a federal map neural network, preprocesses data at edge nodes, only uploads model parameters instead of original data, remarkably reduces the computing, storage and network bandwidth overhead of a central server, and improves the efficiency of the central server. And the problem of high system cost is effectively solved. Meanwhile, by constructing a dynamic topological graph and utilizing a federal map neural network model to deeply learn network structure association, indexes such as'situation influence potential energy 'are introduced to accurately evaluate risks, and the method has closed-loop adaptive ability of model performance monitoring and automatic retraining, so that model drift is effectively overcome, and the risk is accurately evaluated. And long-term, efficient and accurate situation awareness in a dynamic Internet of Things environment is ensured.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) intrusion detection technology, specifically a holographic, multi-dimensional situational awareness management method. Background Technology

[0002] With the explosive growth of the Internet of Things (IoT), the complexity and security challenges of communication network management are becoming increasingly severe. The massive influx of heterogeneous devices and complex network topologies render traditional single-point, planar monitoring methods inadequate in dealing with large-scale coordinated attacks. To address this, a holographic, multi-dimensional situational awareness management approach has emerged. This technology aims to integrate multi-source heterogeneous data such as network traffic, device status, user behavior, and security logs, constructing a dynamic, three-dimensional panoramic view of the network through multi-dimensional correlation analysis and visualization. Particularly in the field of IoT intrusion detection, it transcends isolated security events, achieving deep perception and accurate prediction of potential threats, thus providing key technical support for intelligent proactive defense and efficient collaborative management.

[0003] However, in practical applications, holographic multi-dimensional situational awareness management methods used in communication engineering management often suffer from the following technical drawbacks: Holographic, multi-dimensional situational awareness management methods require real-time collection, aggregation, and processing of information from massive heterogeneous data sources such as network devices, terminals, sensors, and application systems. To achieve deep correlation analysis, pattern recognition, and visualization, the system must rely on high-performance server clusters, large-capacity storage arrays, and high-bandwidth networks. This enormous demand for computing and storage resources directly leads to a sharp increase in system construction and maintenance costs, constituting a common challenge in the practical application of this technology. However, in modern communication networks (especially the Internet of Things), network topology, traffic flow, and device behavior are highly dynamic. A "perfect" model trained in a laboratory or during a specific period may have weak generalization ability (adaptability to new scenarios and devices), and its effectiveness will rapidly diminish over time (i.e., "model drift"). This results in false alarm and false negative rates that may be much higher than expected after actual deployment, posing a serious challenge to the accuracy of situational awareness. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides a holographic multi-dimensional situational awareness management method to overcome the technical deficiencies mentioned in the background section.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a holographic multi-dimensional situational awareness management method, comprising the following steps: S1. Multidimensional state vectors of each node are collected in real time from the distributed edge nodes in the communication network, and combined with global routing information to construct a dynamic topology map of the network, forming a holographic situation dataset. S2. Perform local feature engineering on the raw data collected in step S1 at each edge node to generate a structured node state vector and calculate its local topological features in the dynamic topology graph to achieve edge preprocessing of situational data. S3. Input the node state vector and local topological features processed in step S2 into a global situational awareness model trained on a federated graph neural network; by fusing the node’s intrinsic vulnerability index Crxzs and its threat propagation coefficient Cbxs in the network topology, infer and generate the situational impact potential energy Yxsn of each node. S4. Pre-set the potential energy alarm threshold K, analyze the potential energy distribution of the entire network nodes, identify key risk propagation paths, and calculate the overall network instability Wdx. By comparing the instability with the threshold K, if the network is in an unstable state, generate and issue a topology-aware adaptive security strategy.

[0006] Preferably, in S11, the multidimensional state vector includes: the node's intrinsic state, such as device type, firmware version, and known vulnerability database matching results; the communication behavior state, such as traffic statistics characteristics, abnormal protocol sequence number Xycs, and packet depth detection alarms; and the historical security state, such as the frequency and type of historical attack events. S12. The construction of the dynamic topology graph refers to the real-time monitoring of the communication relationships, data flow and protocol interaction between IoT devices to form a weighted directed graph with devices as nodes and effective communication as edges.

[0007] Preferably, in S21, the local feature engineering includes semantic extraction of unstructured logs and discretization binning of continuous traffic indicators; S22. The local topological features include the degree centrality, betweenness centrality, and average risk level of the nodes and their neighboring nodes, quantifying their importance and environmental risk in the local network structure.

[0008] Preferably, in step S31, the training process of the federated graph neural network model is as follows: Each edge node trains its local federated graph neural network model using local data and local topology subgraphs, and only uploads the gradients and parameters of the federated graph neural network model to the central server. The central server performs secure aggregation of parameters, updates the global federated graph neural network model, and distributes it to each node. The federated graph neural network model updates the central node representation by aggregating neighbor node information, thereby learning the deep relationship between network structure and node features.

[0009] Preferably, in step S32, based on the node's internal state and historical security state, the inherent vulnerability index Crxzs of each node is calculated by weighting and quantifying the severity level of known vulnerabilities, the number of abnormal protocol sequences, and the frequency of historical attack events. The calculation logic is as follows: the more severe the known security vulnerabilities of a node, the more frequent the abnormal communication behavior, and the more times it has been attacked in the past, the higher its inherent vulnerability index.

[0010] Preferably, in step S33, based on the node's position in the dynamic topology graph, a comprehensive evaluation of its topological characteristics, such as degree centrality and betweenness centrality, is performed to obtain the threat propagation coefficient Cbxs for each node; the calculation logic is as follows: The more devices a node connects to in the network and the more critical data forwarding paths it carries, the stronger its potential propagation capability as an attack springboard and the higher its threat propagation coefficient.

[0011] Preferably, in step S34, the inherent vulnerability index Crxzs and the threat propagation coefficient Cbxs are input into the global situational awareness model for nonlinear fitting to obtain the situational impact potential energy Yxsn of the corresponding node; the calculation logic is as follows: The potential impact of a node's situation is positively correlated with its inherent vulnerability index and threat propagation coefficient. That is, a vulnerable node located at the network hub has the greatest potential impact on the entire network if it is compromised.

[0012] Preferably, in step S41, the potential energy of each node's situational influence obtained in step S34 is used to identify the key risk propagation path composed of multiple high-potential-energy nodes using a graph search algorithm. S42. Calculate the overall situation instability Wdx. The calculation logic is as follows: The number of nodes on critical risk propagation paths in the network is a weighted sum of the number of nodes with high potential energy. The higher this value, the more concentrated and easily spread the network risk is, and the more unstable the overall situation is.

[0013] Preferably, in step S43, a potential energy alarm threshold K is preset, and the overall situation instability Wdx is compared and analyzed with the threshold K. If the overall situational instability Wdx is greater than or equal to the potential energy alarm threshold K, the network is judged to be in a state of risk imbalance, and a topology-aware adaptive security strategy is issued. The strategy includes, but is not limited to: performing topology pruning on key risk propagation paths, such as temporarily blocking the communication of unnecessary nodes on the path; or performing dynamic security domain partitioning on high potential energy node clusters to restrict their data interaction with other parts of the network. If the overall instability Wdx is less than the potential energy alarm threshold K, the network is judged to be in a relatively stable state, and the current monitoring level is maintained.

[0014] Preferably, in step S44, the system continuously monitors the comprehensive performance index of the global situational awareness model in the real environment. If the comprehensive performance index continues to decline and falls below the preset model health threshold in multiple consecutive monitoring cycles, it is determined that the model has drifted significantly. The system will automatically trigger a new round of federated graph neural network collaborative retraining to adapt to the evolution of the network environment.

[0015] This invention provides a holographic multi-dimensional situational awareness management method, which has the following beneficial effects: (1) This holographic multidimensional situation control method performs local feature engineering and edge preprocessing on the multidimensional state vectors of each node collected in the distributed edge nodes, and adopts the training mode of federated graph neural network. Only the model gradient and parameters are uploaded to the central server for secure aggregation, which greatly reduces the amount of raw data that needs to be centrally transmitted and processed, effectively reduces the demand for high-performance computing and large-capacity storage of the central server cluster, and significantly saves network bandwidth resources. This solves the problem of high system construction and operation and maintenance costs caused by the centralized processing of massive data in traditional holographic situation control methods. (2) This holographic multi-dimensional situational awareness method constructs a dynamic topology graph to perceive network structure changes in real time, and uses a federated graph neural network model to learn the complex relationship between node features and network topology. By fusing the node’s intrinsic vulnerability index Crxzs and its threat propagation coefficient Cbxs in the network topology, it infers and generates a more forward-looking situational impact potential energy Yxsn, thereby identifying key risk propagation paths and calculating the overall situational instability Wdx, which improves the model’s adaptability to dynamic network environments. Furthermore, this invention designs a closed-loop adaptive mechanism, which continuously monitors the model’s comprehensive performance index and automatically triggers collaborative retraining when the index is lower than the preset model health threshold, effectively overcoming the model drift problem and ensuring the long-term accuracy and high generalization ability of situational awareness. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the steps of the present invention. Detailed Implementation

[0017] The technical solution of the present invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Example 1 Please see Figure 1A holographic, multi-dimensional situational awareness management method includes the following steps: S1. Multidimensional state vectors of each node are collected in real time from the distributed edge nodes in the communication network, and combined with global routing information to construct a dynamic topology map of the network, forming a holographic situation dataset. S2. Perform local feature engineering on the raw data collected in step S1 at each edge node to generate a structured node state vector and calculate its local topological features in the dynamic topology graph to achieve edge preprocessing of situational data. S3. Input the node state vector and local topological features processed in step S2 into a global situational awareness model trained on a federated graph neural network; by fusing the node’s intrinsic vulnerability index Crxzs and its threat propagation coefficient Cbxs in the network topology, infer and generate the situational impact potential energy Yxsn of each node. S4. Pre-set the potential energy alarm threshold K, analyze the potential energy distribution of the entire network nodes, identify key risk propagation paths, and calculate the overall network instability Wdx. By comparing the instability with the threshold K, if the network is in an unstable state, generate and issue a topology-aware adaptive security strategy.

[0019] In this embodiment, the calculation process of the intrinsic vulnerability index Crxzs is as follows: First, the original state data of the node is quantified, wherein the severity level Vscore of the known vulnerability is obtained as the basic score of the general vulnerability scoring system corresponding to the vulnerability, the number of abnormal protocol sequences Panomaly is the count value within the preset monitoring period, and the frequency of historical attack events Afreq is the count value within the preset backtracking period; Second, in order to eliminate the difference in units, the above quantified values ​​are normalized by dividing Vscore by its maximum value of 10.0, and Panomaly and Afreq are truncated by the preset maximum threshold and then divided by the threshold respectively, so that all input values ​​are mapped to the interval [0, 1]; Next, the three normalized values ​​are weighted and summed. In this embodiment, the weight α for Vscore is 0.5, the weight β for Panomaly is 0.3, and the weight γ for Afreq is 0.2. The calculation logic is to multiply the normalized Vscore by the weight α, add the normalized Panomaly by the weight β, and add the normalized Afreq by the weight γ. The resulting intrinsic vulnerability index Crxzs is a value between 0 and 1. The specific calculation formula is as follows: ; In the formula, ThP represents the maximum threshold used for truncating and normalizing Panomaly; ThA represents the maximum threshold used for truncating and normalizing Afreq; min(a, b) is to take the smaller value between a and b. Further, the calculation process of the overall situational instability Wdx is as follows: This calculation is based on the set of nodes on the identified key risk propagation paths and their corresponding situational impact potential energy Yxsn values; First, two core components are calculated: one is the risk scale factor Fscale, which is calculated by dividing the total number of nodes on the risk path by the total number of nodes in the network; the other is the risk concentration factor Fconc, which is calculated by calculating the standard deviation of the Yxsn values ​​of all nodes on the risk path; Second, after normalizing the risk concentration factor Fconc, the two components are weighted and summed. In this embodiment, the weight δ of the risk scale factor is set to 0.4, and the weight ε of the risk concentration factor is set to 0.6; Finally, the calculation logic of Wdx is to multiply the normalized risk scale factor by the weight δ, and add the normalized risk concentration factor multiplied by the weight ε to obtain a comprehensive index between 0 and 1; the specific calculation formula is: Wdx=δ×Fscale+ε×norm(Fconc); Wherein, Wdx is the overall instability index of the network, and its value range is [0, 1]; δ and ε correspond to the weight coefficients of the risk scale factor and the risk concentration factor, respectively. According to the embodiment, their preferred values ​​are δ=0.4, ε=0.6, and δ+ε=1.

[0020] The formula for calculating the Fscale risk size factor is: ; In the formula, Fconc is the risk concentration factor, which is calculated as the standard deviation of the Yxsn values ​​of all nodes on the risk path: ; The potential energy alarm threshold K is used to determine whether network status requires intervention. In a specific implementation of this invention, this threshold is not a fixed value, but is dynamically determined through statistical analysis of historical data from the network's normal operating state. The determination method includes: First, within a known secure period of the network, historical data sequences of overall situational instability (Wdx) for at least one complete business cycle are continuously collected. Second, the mean μ and standard deviation σ of the historical data sequence are calculated. Finally, the potential energy alarm threshold K is set as a linear combination of the historical data mean μ and standard deviation σ. Preferably, in this embodiment, the threshold K is set as the mean μ plus twice the standard deviation σ. This setting logic enables the threshold K to adapt to the baseline level of different network environments and adjust the multiplier between 1.5 times and 3 times the standard deviation according to the strictness level of the security policy.

[0021] Example 2 S11. The multidimensional state vector includes: the node's intrinsic state, such as device type, firmware version, and known vulnerability database matching results; the communication behavior state, such as traffic statistics characteristics, abnormal protocol sequence number Xycs, and data packet depth detection alarms; and the historical security state, such as the frequency and type of historical attack events. S12. The construction of the dynamic topology graph refers to the real-time monitoring of the communication relationships, data flow and protocol interaction between IoT devices to form a weighted directed graph with devices as nodes and effective communication as edges.

[0022] S21. The local feature engineering includes semantic extraction of unstructured logs and discretization binning of continuous traffic indicators. S22. The local topological features include the degree centrality, betweenness centrality, and average risk level of the nodes and their neighboring nodes, quantifying their importance and environmental risk in the local network structure.

[0023] S31. The training process of the federated graph neural network model is as follows: Each edge node trains its local federated graph neural network model using local data and local topology subgraphs, and only uploads the gradients and parameters of the federated graph neural network model to the central server. The central server performs secure aggregation of parameters, updates the global federated graph neural network model, and distributes it to each node. The federated graph neural network model updates the central node representation by aggregating neighbor node information, thereby learning the deep relationship between network structure and node features.

[0024] S32. Based on the node's intrinsic state and historical security state, the intrinsic vulnerability index Crxzs of each node is calculated by weighting and quantifying the severity level of known vulnerabilities, the number of abnormal protocol sequences, and the frequency of historical attack events; the calculation logic is as follows: The more serious the known security vulnerabilities of a node, the more frequent its abnormal communication behavior, and the more times it has been attacked in the past, the higher its inherent vulnerability index.

[0025] S33. Based on the node's position in the dynamic topology graph, the threat propagation coefficient Cbxs of each node is obtained by comprehensively evaluating its topological characteristics such as degree centrality and betweenness centrality; the calculation logic is as follows: The more devices a node connects to in the network and the more critical data forwarding paths it carries, the stronger its potential propagation capability as an attack springboard and the higher its threat propagation coefficient.

[0026] S34. By inputting the intrinsic vulnerability index Crxzs and the threat propagation coefficient Cbxs into the global situational awareness model for nonlinear fitting, the situational impact potential energy Yxsn of the corresponding node is obtained; the calculation logic is as follows: The potential impact of a node's situation is positively correlated with its inherent vulnerability index and threat propagation coefficient. That is, a vulnerable node located at the network hub has the greatest potential impact on the entire network if it is compromised.

[0027] S41. Using the potential energy of each node's situational influence obtained in step S34, a graph search algorithm is used to identify the key risk propagation path composed of multiple high-potential-energy nodes. S42. Calculate the overall situation instability Wdx. The calculation logic is as follows: The number of nodes on critical risk propagation paths in the network is a weighted sum of the number of nodes with high potential energy. The higher this value, the more concentrated and easily spread the network risk is, and the more unstable the overall situation is.

[0028] S43. A potential energy alarm threshold K is preset, and the overall situation instability Wdx is compared and analyzed with the threshold K. If the overall situational instability Wdx is greater than or equal to the potential energy alarm threshold K, the network is judged to be in a state of risk imbalance, and a topology-aware adaptive security strategy is issued. The strategy includes, but is not limited to: performing topology pruning on key risk propagation paths, such as temporarily blocking the communication of unnecessary nodes on the path; or performing dynamic security domain partitioning on high potential energy node clusters to restrict their data interaction with other parts of the network. If the overall instability Wdx is less than the potential energy alarm threshold K, the network is judged to be in a relatively stable state, and the current monitoring level is maintained.

[0029] S44. The system continuously monitors the comprehensive performance index of the global situational awareness model in the real environment. If the comprehensive performance index continues to decline and falls below the preset model health threshold in multiple consecutive monitoring periods, it is determined that the model has drifted significantly. The system will automatically trigger a new round of federated graph neural network collaborative retraining to adapt to the evolution of the network environment.

[0030] In this embodiment, the threat propagation coefficient Cbxs comprehensively evaluates the importance of a node in the network topology; its calculation logic is a comprehensive evaluation of multiple topological features, which can be represented as a function, with a preferred embodiment being a linear weighted model; the specific calculation formula is as follows: Cbxs=f(CD （v） ,(CB （v） ,…); A preferred linear weighted model is shown below: Cbxs=w1×CD （v）norm +w2×CB （v）norm ; Where: f() represents the comprehensive evaluation function, which can be a linear or nonlinear model; v represents the node currently being evaluated; CD （v） Indicate the degree centrality of node v; CB （v) denoted by the betweenness centrality of node v; w1 and w2 correspond to the weight coefficients of each topological feature, satisfying w1+w2=1; ()norm represents the normalization of the topological feature values, mapping them to the interval [0,1]. The situational impact potential energy Yxsn is a nonlinear fitting result of node intrinsic vulnerability and network topological importance, generated by the global situational awareness model, i.e., federated graph neural network inference. The specific calculation formula is as follows: Yxsn=f GNN (Crxzs,Cbxs); Among them, f GNN This represents the nonlinear mapping function performed by the trained Global Situational Awareness Model (GNN). This function takes the node's intrinsic vulnerability index Crxzs and threat propagation coefficient Cbxs as input and outputs its combined impact potential. The "Federated Graph Neural Network Model," as a concrete implementation of the global situational awareness model, is a GraphSAGE model. Its network structure includes: an input layer matching the dimension of the initial feature vectors of the nodes; two GraphSAGE aggregation layers using ReLU activation as hidden layers, each with 64 hidden units; and an output layer consisting of a fully connected layer and a Sigmoid activation function, outputting a single value between 0 and 1, namely the situational impact potential energy Yxsn. The model's training labels are generated through backtracking analysis of historical security logs, where nodes confirmed to have experienced high-risk security events are assigned a positive label of 1, and nodes with normal communication behavior are assigned a negative label of 0. During federated training, each edge node uses binary cross-entropy as the loss function and the Adam optimizer for local training, with a learning rate set to 0.001 and a local training cycle of 5. The central server executes a federated averaging algorithm to safely aggregate the gradients uploaded by each node. The entire federated training process involves 50 global aggregation rounds to ensure model convergence.

[0031] The process of identifying "critical risk propagation paths" is as follows: First, node screening is performed. Based on the statistical distribution of the potential energy Yxsn value of the entire network node situation, the system sets a "high potential energy node threshold" Y_th. In this embodiment, the threshold is preferably the top 5% quantile of the Yxsn value. All nodes with Yxsn values ​​not less than this threshold are marked as "high potential energy nodes" and form a candidate subgraph. Second, path search is performed on the candidate subgraph. Specifically, the depth-first search (DFS) algorithm is used, starting from the node with the highest potential energy in the candidate subgraph as the starting point for traversal. The constraint condition for traversal is that the next adjacent node on the path must also be a "high potential energy node". Finally, a risk path set is generated. Each complete node sequence traversed from the starting point to the leaf node that terminates due to failure to meet the constraint condition is recorded as a "critical risk propagation path". All risk propagation paths in the network that meet the conditions are identified by traversing all candidate nodes as potential starting points.

[0032] The "model health threshold" is not a fixed value, but is dynamically correlated with the model performance baseline. The "comprehensive performance index" used to evaluate the model is explicitly defined as the F1 score of the global situational awareness model on a reserved, continuously updated validation dataset. The specific method for determining this threshold is as follows: after each round of federated retraining and deployment of the new model, the system immediately evaluates the new model on the validation set to obtain its initial best F1 score, denoted as F1_initial. Subsequently, the system dynamically sets the "model health threshold" to a fixed percentage of this initial best performance; in this embodiment, this percentage is preferably set to 85%. Therefore, if, during subsequent continuous monitoring, the model's real-time calculated F1 score is lower than the threshold obtained by multiplying the initial best F1 score by 0.85 for three consecutive monitoring periods, the system determines that the model performance has significantly drifted and automatically triggers a new round of retraining.

[0033] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A holographic multi-dimensional situational awareness management method, characterized in that, Includes the following steps: S1. Multidimensional state vectors of each node are collected in real time from the distributed edge nodes in the communication network, and combined with global routing information to construct a dynamic topology map of the network, forming a holographic situation dataset. S2. Perform local feature engineering on the raw data collected in step S1 at each edge node to generate a structured node state vector and calculate its local topological features in the dynamic topology graph to achieve edge preprocessing of situational data. S3. Input the node state vector and local topological features processed in step S2 into a global situational awareness model trained on a federated graph neural network; by fusing the node’s intrinsic vulnerability index Crxzs and its threat propagation coefficient Cbxs in the network topology, infer and generate the situational impact potential energy Yxsn of each node. S4. Pre-set the potential energy alarm threshold K, analyze the potential energy distribution of the entire network nodes, identify key risk propagation paths, and calculate the overall network instability Wdx. By comparing the instability with the threshold K, if the network is in an unstable state, generate and issue a topology-aware adaptive security strategy.

2. The holographic multi-dimensional situational awareness management method according to claim 1, characterized in that: S11. The multidimensional state vector includes: the node's intrinsic state, such as device type, firmware version, and known vulnerability database matching results; the communication behavior state, such as traffic statistics characteristics, abnormal protocol sequence number Xycs, and data packet depth detection alarms; and the historical security state, such as the frequency and type of historical attack events. S12. The construction of the dynamic topology graph refers to the real-time monitoring of the communication relationships, data flow and protocol interaction between IoT devices to form a weighted directed graph with devices as nodes and effective communication as edges.

3. The holographic multi-dimensional situational awareness management method according to claim 1, characterized in that: S21. The local feature engineering includes semantic extraction of unstructured logs and discretization binning of continuous traffic indicators. S22. The local topological features include the degree centrality, betweenness centrality, and average risk level of the nodes and their neighboring nodes, quantifying their importance and environmental risk in the local network structure.

4. The holographic multi-dimensional situational awareness management method according to claim 1, characterized in that: S31. The training process of the federated graph neural network model is as follows: Each edge node trains its local federated graph neural network model using local data and local topology subgraphs, and only uploads the gradients and parameters of the federated graph neural network model to the central server. The central server performs secure aggregation of parameters, updates the global federated graph neural network model, and distributes it to each node. The federated graph neural network model updates the central node representation by aggregating neighbor node information, thereby learning the deep relationship between network structure and node features.

5. The holographic multi-dimensional situational awareness management method according to claim 1, characterized in that: S32. Based on the node's internal state and historical security state, the inherent vulnerability index Crxzs of each node is calculated by weighting and quantifying the severity level of known vulnerabilities, the number of abnormal protocol sequences, and the frequency of historical attack events. The calculation logic is as follows: the more severe the known security vulnerabilities of a node, the more frequent the abnormal communication behavior, and the more times it has been attacked in the past, the higher its inherent vulnerability index.

6. The holographic multi-dimensional situational awareness management method according to claim 1, characterized in that: S33. Based on the position of the node in the dynamic topology graph, the threat propagation coefficient Cbxs of each node is obtained by comprehensively evaluating its topological characteristics such as degree centrality and betweenness centrality. Its calculation logic is as follows: The more devices a node connects to in the network and the more critical data forwarding paths it carries, the stronger its potential propagation capability as an attack springboard and the higher its threat propagation coefficient.

7. The holographic multi-dimensional situational awareness management method according to claim 1, characterized in that: S34. By inputting the intrinsic vulnerability index Crxzs and the threat propagation coefficient Cbxs into the global situational awareness model for nonlinear fitting, the situational impact potential energy Yxsn of the corresponding node is obtained; the calculation logic is as follows: The potential impact of a node's situation is positively correlated with its inherent vulnerability index and threat propagation coefficient. That is, a vulnerable node located at the network hub has the greatest potential impact on the entire network if it is compromised.

8. The holographic multi-dimensional situational awareness management method according to claim 7, characterized in that: S41. Using the potential energy of each node's situational influence obtained in step S34, a graph search algorithm is used to identify the key risk propagation path composed of multiple high-potential-energy nodes. S42. Calculate the overall situation instability Wdx. The calculation logic is as follows: The number of nodes on critical risk propagation paths in the network is a weighted sum of the number of nodes with high potential energy. The higher this value, the more concentrated and easily spread the network risk is, and the more unstable the overall situation is.

9. The holographic multi-dimensional situational awareness management method according to claim 1, characterized in that: S43. A potential energy alarm threshold K is preset, and the overall situation instability Wdx is compared and analyzed with the threshold K. If the overall situational instability Wdx is greater than or equal to the potential energy alarm threshold K, the network is judged to be in a state of risk imbalance, and a topology-aware adaptive security strategy is issued. The strategy includes, but is not limited to: performing topology pruning on key risk propagation paths, such as temporarily blocking the communication of unnecessary nodes on the path; or performing dynamic security domain partitioning on high potential energy node clusters to restrict their data interaction with other parts of the network. If the overall instability Wdx is less than the potential energy alarm threshold K, the network is judged to be in a relatively stable state, and the current monitoring level is maintained.

10. A holographic multi-dimensional situational awareness management method according to claim 9, characterized in that: S44. The system continuously monitors the comprehensive performance index of the global situational awareness model in the real environment. If the comprehensive performance index continues to decline and falls below the preset model health threshold in multiple consecutive monitoring periods, it is determined that the model has drifted significantly. The system will automatically trigger a new round of federated graph neural network collaborative retraining to adapt to the evolution of the network environment.

Images