Self-adaptive network security situation awareness method and device combined with online learning

Abstract

The invention provides a self-adaptive network security situation awareness method and device combined with online learning, and the method comprises the steps: collecting real-time network state data and system load index data of a preset data source, carrying out the preprocessing of the data to form a multi-modal time sequence segment, inputting a pre-training time sequence data prediction model activated by employing Monte Carlo Dropout through a sliding window, and carrying out the prediction of the real-time network state data and system load index data. The method comprises the following steps of: calculating a prediction value of a next time period, outputting a prediction value and an uncertainty quantity of the next time period, calculating a threat probability through historical residual probability distribution fitting, realizing double-index risk assessment based on a preset threshold interval system, dividing into three types of states, and finally, respectively triggering online learning, configuration maintenance or intervention disposal flow for different states. According to the method, by introducing uncertainty quantized double-index evaluation and state-driven online learning closed loop, crossing of network security situation awareness from static detection to dynamic self-adaption is achieved, and the two core problems of insufficient real-time performance and concept drift in an edge computing scene are effectively solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security situation awareness, and particularly relates to an adaptive network security situation awareness method and device combined with online learning. BACKGROUND

[0002] Network security situation awareness technology is one of the core technologies in the field of network security, and its classic model usually contains three levels of situation element acquisition, situation understanding and situation prediction. With the evolution of network architecture to multi-modal and complexity, this technology has become a key means to ensure the security of cyberspace.

[0003] In the early stage of technology development, network security situation awareness mainly relies on analysis methods based on feature engineering, which extracts discriminative features from raw network data (such as traffic packets, logs) to build detection models. Such methods have certain effectiveness in the period when the network structure is relatively simple, but their feature representation ability is limited and it is difficult to adapt to the complex and high-dimensional data characteristics in the multi-modal network environment.

[0004] To overcome the limitations of feature engineering, the current mainstream research direction gradually shifts to using deep learning technology to automatically learn shared representations from different modal network data. Specifically, in the aspect of anomaly detection, existing technologies mostly use unsupervised or semi-supervised learning algorithms such as isolation forest, support vector machine or autoencoder to identify anomalies by building normal behavior benchmark models; in the classification and prediction tasks, supervised learning algorithms such as decision tree, random forest and XGBoost are commonly used to classify security events or make predictions based on historical data.

[0005] However, the above existing technical solutions still have significant defects, mainly in the following two aspects: First, there is a bottleneck in computational efficiency and real-time performance. Processing massive multi-modal data requires extremely high computing power and algorithm efficiency. Feature engineering methods have insufficient representation ability, while powerful deep learning models (such as large Transformers) can improve detection accuracy, but they have a huge number of parameters and high computational complexity. In edge computing scenarios that require extremely high real-time performance, the time required for a single model inference may far exceed the interval between data packet arrivals, making it difficult to meet the demand for real-time or near real-time response.

[0006] Secondly, there are data distribution differences and concept drift problems. Most of the existing network security situation awareness models belong to static models or batch learning models, and the parameters are fixed once the training is completed. However, the data distribution of different network environments (such as enterprise networks, data centers, and cloud environments) is significantly different, and the normal behavior patterns and attack methods in the network also dynamically evolve over time (i.e., concept drift). This will result in a sharp decline in performance when the model trained in a specific environment or historical period is deployed to another environment or faces future data due to data distribution mismatch, and lack of adaptive ability to dynamically changing network environment.

[0007] Therefore, there is an urgent need in the art for a network security situation awareness technology solution that is lightweight, highly real-time, and can continuously adapt to changes in data distribution. SUMMARY

[0008] In view of this, the embodiments of the present application provide an adaptive network security situation awareness method and device combined with online learning to solve the problems of insufficient real-time performance caused by high model calculation complexity and the inability of static models to adapt to data distribution changes and concept drift in the existing network security situation awareness technology in edge computing scenarios.

[0009] In one aspect, the present application provides an adaptive network security situation awareness method combined with online learning, which comprises the following steps: Collecting network status data and system load indicator data of real-time network data stream from a preset data source, and forming multi-modal time series segments after data preprocessing; Inputting the multi-modal time series segments of the current period into a pre-trained time series data prediction model through a sliding window to output the predicted value and its uncertainty of the multi-modal time series segments of the next period; wherein the time series data prediction model uses Monte Carlo Dropout for activation in the prediction process, performs a certain number of forward propagations on a single input, takes the prediction mean as the predicted value, and takes the prediction variance as the uncertainty to measure the certainty of the prediction result; Fitting the probability distribution of the residual values of the predicted values and true values of multiple historical periods, and calculating the probability of the residual values between the predicted values and true values of the next period to measure the network threat; Based on a preset threshold interval system, using the uncertainty and the probability of the next period to perform double-index risk assessment, dividing a class of states with uncertain model, a class of states with determined model and normal network, and a class of states with determined model and network threat, and realizing network security situation awareness; For the first type of state, online learning is triggered, and data from the second type of state continuously recorded in the data buffer is sampled for incremental updates to the time series data prediction model and the probability distribution; for the second type of state, the current network configuration is maintained; for the third type of state, a preset intervention and handling procedure is triggered.

[0010] In some embodiments, the data preprocessing includes removing duplicate and outlier values ​​from the network status data and the system load index data, filling in missing values ​​using linear interpolation, and feature normalization.

[0011] In some embodiments, the time-series data prediction model is pre-trained based on a long short-term memory network, a temporal convolutional network, or a Transformer model. The pre-training steps include: Obtain the training dataset, which includes sample network state data and sample system load index data under normal conditions, and combine them to obtain multimodal sample time series segments; A sliding window is used to continuously extract multimodal sample time segments of a set length and input them into an initial time series data prediction model. The initial time series data prediction model performs the set number of forward propagations on the same input and outputs the predicted mean and prediction variance of the multimodal sample time segments for the next time period. The initial time series data prediction model is trained using the training sample set and activated using Monte Carlo Dropout. The parameters are updated based on the deviation between the predicted values ​​and the true values ​​to obtain the time series data prediction model. The formula for calculating the predicted mean is: ; The formula for calculating the prediction variance is: ; This represents the predicted mean. T This indicates the set quantity; This represents the predicted value obtained during the t-th forward propagation; This represents the predicted variance.

[0012] In some embodiments, the residual values ​​of the predicted values ​​and the actual values ​​for multiple historical periods are fitted with a probability distribution, including: using a Gaussian mixture model or a normalized flow model to fit the probability distribution.

[0013] In some embodiments, the method employs an online EM algorithm to update the Gaussian mixture model of the probability distribution using data from the two states, and the steps include: The posterior probability of the data belonging to each component of the probability distribution under the two states is calculated as the responsibility value. The sufficient statistic of the Gaussian mixture model is updated using the responsibility value, and the parameters of the Gaussian mixture model are updated based on the updated sufficient statistic.

[0014] In some embodiments, the method further includes: actively initiating updates to the time-series data prediction model and the probability distribution according to a specified time interval.

[0015] In some embodiments, the method maintains the current network configuration for the two types of states, including: continuous monitoring and logging, system health checks and maintenance, execution of security policies and configurations, and reporting and visualization of network security situation awareness results; The preset intervention and handling process is triggered for the three types of states, including: performing network layer isolation, terminating sessions and connections, performing host layer containment, performing full traffic packet capture, triggering the preset investigation script of the security orchestration and response platform to find threats, and generating alarm prompts and reporting.

[0016] On the other hand, the present invention provides an adaptive network security situation awareness device that incorporates online learning, including a processor, a memory, and a computer program or instructions stored in the memory. The processor is used to execute the computer program or instructions, and when the computer program or instructions are executed, the device performs the steps of the above-described method.

[0017] On the other hand, the present invention provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0018] On the other hand, the present invention provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method.

[0019] The adaptive network security situation awareness method and device combined with online learning described in this invention ensures the comprehensiveness of situation awareness information through multimodal time-series data fusion processing; it uses Monte Carlo Dropout to quantify prediction uncertainty, solving the problem of difficulty in measuring the reliability of traditional model predictions; a dual-index risk assessment mechanism combines prediction uncertainty and threat probability to judge the network security situation, improving the accuracy of situation judgment and avoiding misjudgments; online learning is triggered for uncertain model states, using incremental updates of the model and probability distribution with two types of state data to achieve dynamic model adaptation and enhanced adaptability to changes in the network environment; the classification and handling process makes network security response more targeted, ensuring normal network operation efficiency while timely handling of security threats, effectively improving the intelligence and reliability of network security protection.

[0020] Additional advantages, objects, and features of the invention will be set forth in part in the description which follows, and will also become apparent in part to those skilled in the art upon studying the text, or may be learned by practice of the invention. The objects and other advantages of the invention can be realized and obtained by means of the structures specifically pointed out in the description and drawings.

[0021] Those skilled in the art will understand that the objectives and advantages achievable with the present invention are not limited to those specifically described above, and that the above and other objectives achievable with the present invention will become clearer from the following detailed description. Attached Figure Description

[0022] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, are not intended to limit the scope of the invention. In the drawings: Figure 1 This is a flowchart illustrating an embodiment of the adaptive network security situation awareness method incorporating online learning according to an embodiment of the present invention.

[0023] Figure 2 This is a logical schematic diagram of a network security situation awareness method based on LSTM-GMM and online learning according to an embodiment of the present invention. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the embodiments and accompanying drawings. Here, the illustrative embodiments and descriptions of this invention are used to explain the invention, but are not intended to limit the invention.

[0025] It should also be noted that, in order to avoid obscuring the invention with unnecessary details, only the structures and / or processing steps closely related to the solution according to the invention are shown in the accompanying drawings, while other details that are not closely related to the invention are omitted.

[0026] It should be emphasized that the term "including / comprises" as used herein refers to the presence of a feature, element, step, or component, but does not exclude the presence or addition of one or more other features, elements, steps, or components.

[0027] The field of network security situation awareness still faces many challenges: (1) Computational efficiency and real-time bottlenecks: Processing massive multimodal data requires extremely high computing power and algorithm efficiency, especially in scenarios that require real-time or near-real-time responses. Although feature engineering technology can quickly extract the core features of data, it cannot meet the complex data scenarios of multimodal networks and has insufficient representation capabilities. Although advanced deep learning models (such as large Transformers) have powerful performance, they usually have a huge number of parameters and are computationally complex. In scenarios with extremely high real-time requirements, the time required for a model inference may far exceed the interval between data packet arrivals. (2) Data distribution differences and concept drift: Most existing network security situation awareness models are static models or batch learning models, and their core defects are model solidification and performance degradation. However, there are significant differences in data distribution in different network environments (such as enterprise networks, data centers, and cloud environments), and the statistical laws behind attack patterns or normal behaviors in network environments will also change over time. For example, an anomaly detection model trained in one network environment may experience a sharp performance drop when deployed in another network environment with a different structure, application, or user behavior pattern, due to the mismatch between the training data and the real-time data distribution, thus failing to meet the requirements of multimodal networks.

[0028] This invention aims to address the core challenges of network situational awareness in multimodal network edge computing scenarios: computational efficiency and real-time performance bottlenecks, as well as data distribution discrepancies and concept drift. Therefore, the primary objective of this invention is to design a lightweight deep prediction network that compensates for the insufficient representational capabilities of feature engineering techniques while avoiding the real-time performance limitations caused by the high computational demands of deep networks. Another key objective is to introduce an online learning mechanism oriented towards concept drift, enabling the model to continuously evolve from the constantly changing real-world network flow.

[0029] Specifically, this invention provides an adaptive network security situation awareness method that combines online learning, such as... Figure 1 As shown, the method includes the following steps S101~S105: Step S101: Collect network status data and system load index data of real-time network data stream from a preset data source, and form a multimodal time series segment after data preprocessing.

[0030] Step S102: Input the multimodal time series segment of the current time period into the pre-trained time series data prediction model through a sliding window to output the predicted value and its uncertainty for the multimodal time series segment of the next time period; wherein, the time series data prediction model uses Monte Carlo Dropout for activation during the prediction process, performs a set number of forward propagations on a single input, uses the prediction mean as the predicted value, and uses the prediction variance as the uncertainty to measure the certainty of the prediction result.

[0031] Step S103: Fit the probability distribution of the residual values ​​between the predicted and actual values ​​for multiple historical periods, and calculate the probability of the residual values ​​between the predicted and actual values ​​for the next period to measure the network threat.

[0032] Step S104: Based on the preset threshold interval system, use the uncertainty and probability corresponding to the next time period to conduct a dual-indicator risk assessment, divide the state into three categories: a first category where the model is uncertain, a second category where the model is certain and the network is normal, and a third category where the model is certain and the network is threatened, so as to realize network security situation awareness.

[0033] Step S105: For the first type of state, online learning is triggered, and data from the second type of state continuously recorded in the data buffer is sampled for incremental updates to the time series data prediction model and for updating the probability distribution; for the second type of state, the current network configuration is maintained; for the third type of state, a preset intervention and handling procedure is triggered.

[0034] Step S101 is the basic data input stage, which explicitly involves collecting network status data and system load indicator data. Network status data includes, but is not limited to, TCP / UDP traffic statistics, connection counts, and packet size distribution. System load indicator data includes, but is not limited to, CPU / memory / disk utilization. This reflects the technical approach emphasized in the disclosure document for addressing multimodal network architectures. By integrating data from different dimensions, a rich information foundation is provided for comprehensively understanding the network security situation.

[0035] In some embodiments, the data preprocessing includes removing duplicate and outlier values ​​from the network status data and the system load index data, filling in missing values ​​using linear interpolation, and feature normalization.

[0036] This process includes data cleaning, such as removing duplicate records and correcting invalid values; missing value imputation, such as using linear / periodic interpolation; and feature normalization, such as normalization of continuous values ​​and one-hot encoding of categorical values. Its purpose is to transform the raw, messy data into well-organized, clean time-series segments suitable for model input, laying the foundation for the stability and accuracy of the subsequent model.

[0037] In step S102, the time-series data prediction model is pre-trained on normal network data. Therefore, under stable network conditions without interference or attack threats, the prediction of multimodal time-series data by the time-series data prediction model should be relatively deterministic. Therefore, this application introduces Monte Carlo Dropout for activation in both the training and prediction phases of the model. Monte Carlo Dropout (MC Dropout) is an advanced technique in deep learning that approximates Bayesian inference. It cleverly utilizes standard Dropout layers to quantify the uncertainty of the model's prediction results without significantly increasing model complexity and computational overhead.

[0038] The implementation mechanism is as follows: unlike traditional Dropout which is only activated during training, this invention uses MC Dropout to keep the Dropout layer active even during model prediction. This means that random neurons are dropped during each forward propagation. By performing multiple such randomized forward propagations on the same input sample, T slightly different prediction results are obtained. The distribution of these prediction results approximately reflects the posterior distribution of the model. The mean of these T results can be calculated as the final prediction value, and their variance can be calculated to quantify the uncertainty of the model. The larger the variance, the greater the disagreement among different internal viewpoints of the model, that is, the more uncertain the model is about the current prediction.

[0039] In this invention, MC Dropout is applied to time-series data prediction models. Its core purpose is to quantify the uncertainty of model predictions, adding a crucial dimension of credibility to situational awareness. When a model faces inputs it has never seen before or that differ significantly from the training data distribution—such as a novel attack or a fundamental change in the network environment—the variance of its predictions increases significantly. This uncertainty metric is crucial; it is not only a core input in the three-level risk assessment framework, but more importantly, it serves as a key signal to trigger online learning mechanisms, enabling the model to proactively identify its cognitive blind spots and initiate self-evolution.

[0040] In some embodiments, the time-series data prediction model is obtained by pre-training based on a long short-term memory network, a temporal convolutional network, or a Transformer model. For example, this invention employs LSTM, or Long Short-Term Memory, a special type of recurrent neural network (RNN) designed to solve problems such as time series prediction. Its core advantage lies in its ability to effectively learn and remember long-term dependencies in data, thus overcoming the limitations of traditional RNNs in processing long sequences where gradient vanishing or exploding makes it difficult to transfer and utilize historical information. LSTM uses its unique gating mechanism, including forget gates, input gates, and output gates, to finely control the flow and retention of information within the network. The forget gate determines which information should be discarded from the unit's memory. It examines the output of the previous time step and the input of the current time step, then decides which old information is irrelevant and forgets it. The input gate is responsible for deciding which new information should be stored in the unit's memory. It judges which information in the current input is important and allows this valuable information to be updated in memory. The output gate, based on the unit's current memory state, determines what information should be output at the current time step. It ensures that the output is a comprehensive consideration of long-term memory and current input. Through the coordinated work of these three gates, LSTM can selectively retain important information and discard irrelevant information, allowing its memory to be both long-term and dynamically updated. This ingenious mechanism makes LSTM perform exceptionally well when processing time-series data with long-span dependencies. In this invention, LSTM forms the foundational module for time-series prediction. It is used to model multimodal time-series data such as network traffic and system load, and by learning dynamic patterns from historical data, it accurately predicts normal behavior at the next moment. This prediction provides an accurate and dynamic benchmark for subsequent anomaly detection, representing the first step towards achieving high-precision situational awareness.

[0041] For example, this invention can also use the standard Transformer model to capture global dependencies in a sequence through a self-attention mechanism. However, its computational complexity and memory consumption increase quadratically with the sequence length, making it difficult to directly apply to long-sequence time-series prediction. Lightweight Transformer models (such as Informer and Autoformer) significantly reduce computational overhead while maintaining performance by improving the attention mechanism and structural design. Standard self-attention calculates attention weights using a query (Q), key (K), and value (V) matrix: .

[0042] in, Each from the input sequence Obtained by linear transformation, For sequence length, For the feature dimension, the computational complexity of this mechanism is O(n). .

[0043] ProbSparse self-attention reduces the size of the attention matrix by selecting only the top-u important queries. The calculation formula is as follows: .

[0044] in, The sparsed query matrix contains only those with the largest divergence from KL. One query. Selected using empirical formulas: Where c is a constant. The complexity is reduced to .

[0045] The encoder structure uses a ProbSparse self-attention layer followed by a distillation module to compress the sequence length. .

[0046] Using a standard self-attention layer, a predicted sequence is generated from the encoder output and a known sequence as input.

[0047] The specific process of using lightweight Transformer for time series forecasting and uncertainty quantification: a) Input the input sequence into the lightweight Transformer encoder-decoder, and output the predicted sequence. , where T is the prediction step size.

[0048] b) Integrate MC Dropout into all feedforward layers of the Transformer, maintaining Dropout activation during the inference phase. Perform T forward propagations (e.g., T=50) on the same input, using a different random mask each time to obtain a set of predicted values. .

[0049] c) Calculate the predicted mean as the final output: .

[0050] Calculate the prediction variance as a measure of uncertainty: .

[0051] For example, the present invention can also employ a Temporal Convolutional Network (TCN), a convolutional neural network architecture specifically designed for modeling time-series data. Its core uses stacked causal convolutions and dilated convolutions to capture long-term dependencies in a sequence. Its model structure supports parallel computation, resulting in faster training and inference speeds. It structurally avoids the vanishing or exploding gradient problems and provides more stable capture of long-term dependencies. However, the model typically consumes more memory than an equivalent LSTM, and for some highly dynamic sequences without obvious periodicity, its flexibility may be slightly inferior to recurrent neural networks.

[0052] Causal convolution ensures that the model's output at time t depends only on the input at time t and earlier, preventing the leakage of future information and satisfying the causality requirement of time series prediction. For a one-dimensional input sequence... convolution kernel The causal convolution output at time t is: .

[0053] Dilated convolution expands the receptive field by inserting holes between kernel elements, enabling it to capture longer-term dependencies without increasing kernel size or the number of parameters. The output of a convolution with a dilation factor of 'd' at time t is: .

[0054] Construct a network consisting of stacked TCN residual blocks. The hole factor d of each residual block increases exponentially with the number of layers (e.g., d = d for the i-th layer). This allows the top-level neurons to have a receptive field that covers the entire length of the input sequence.

[0055] The specific process of using TCN for time series forecasting and uncertainty quantification: a) Input multimodal time series data into the TCN network and output the predicted value for the next time step. .

[0056] b) Integrate MC Dropout after all convolutional layers of the TCN network, maintaining Dropout activation during inference. Perform T forward propagations (e.g., T=50) on the same input, each using a different random mask to obtain the set of predicted values. .

[0057] c) Calculate the predicted mean as the final output. .

[0058] Calculate the prediction variance as a measure of uncertainty .

[0059] Furthermore, the pre-training steps of the time series data prediction model include steps S1021~S1022: Step S1021: Obtain the training dataset, which includes sample network state data and sample system load index data under normal conditions, and combine them to obtain multimodal sample time series segments.

[0060] Step S1022: Using a sliding window, continuously extract multimodal sample time segments of a set length and input them into the initial time series data prediction model. The initial time series data prediction model performs a set number of forward propagations on the same input and outputs the predicted mean and prediction variance of the multimodal sample time segments for the next time period. The initial time series data prediction model is trained using a training sample set and activated using Monte Carlo Dropout. The parameters are updated by constructing a loss based on the deviation between the predicted value and the true value to obtain the time series data prediction model.

[0061] The formula for calculating the predicted mean is: ; The formula for calculating the prediction variance is: ; This represents the predicted mean. T Indicates the set quantity; This represents the predicted value obtained during the t-th forward propagation; This represents the prediction variance.

[0062] In step S103, the prediction error is converted into an interpretable cybersecurity threat metric.

[0063] Calculating the residual between predicted and actual values ​​is a classic approach to anomaly detection. The principle is that a well-trained model should have a small prediction error (residual) for normal behavior that follows a stable distribution. A Gaussian Mixture Model (GMM) is used to fit the distribution of historical normal residuals. This is because "normal" behavior itself has multiple patterns (e.g., different patterns on weekdays and weekends), and the GMM can flexibly characterize this complex distribution using a weighted sum of multiple Gaussian distributions, making it more accurate than a single Gaussian model. For a new residual, its probability of occurrence is calculated using the fitted GMM. The lower the probability, the more the residual deviates from historical normal patterns, and the higher the network threat it represents.

[0064] In some embodiments, the residual values ​​of predicted values ​​and actual values ​​for multiple historical periods are fitted with a probability distribution, including: using a Gaussian mixture model or a normalized flow model to fit the probability distribution.

[0065] For example, this invention can employ a Gaussian Mixture Model (GMM), a powerful probability density estimation method widely used in statistics and machine learning to model complex data distributions. Its core idea is that any complex data distribution can be viewed as a weighted sum of several simple Gaussian (normal) distributions. Each Gaussian distribution is called a component, representing a "cluster" or latent pattern in the data. By learning the mean, variance, and their mixing weights for each Gaussian component, GMM can flexibly fit probability distributions of various shapes, especially non-standard distributions with multiple peaks (multimodal).

[0066] In cybersecurity scenarios, normal system behavior is often not singular and fixed, but may exhibit multiple patterns. For example, traffic patterns during the daytime on weekdays are drastically different from those at night or on weekends. Therefore, the residual distribution between LSTM model predictions and actual observations may not be a simple unimodal normal distribution. In this invention, Gaussian Mixture Models (GMMs) are chosen to probabilistically model the residual sequence under normal operating conditions, which is more accurate than a single Gaussian model. GMMs can capture multiple distribution patterns of residuals under different normal operating modes, thereby constructing a more refined and realistic profile of normal behavior. For any new residual value, GMMs can calculate the probability that it belongs to this normal profile. Residuals with extremely low probability values ​​are highly suspected of abnormal behavior, thus effectively distinguishing normal system fluctuations from potential security threats.

[0067] For example, the present invention can also use normalizing flows instead of GMM. Using a normalizing flow model consisting of a series of invertible transformations to replace the Gaussian mixture model for probability density modeling of the residual sequence can characterize more complex network behaviors. However, the model structure and training process are relatively complex, the computational cost is usually greater than that of GMM, and more data may be required to achieve stable performance.

[0068] The core idea of ​​normalized flow is to use a series of bijective transformation functions whose invertible determinants are easy to compute. This maps a simple prior probability distribution to a complex target data distribution. Given a data point... The corresponding point in the prior space can be obtained through inverse transformation. By using the variable transformation formula, data points can be calculated accurately. Log probability density: .

[0069] in, It is the first The input of the layer transformation, It is the first The Jacobian determinant of the inverse of the layer transformation. Through carefully designed transformations... This makes its inverse and Jacobian determinant easy to compute, thus enabling efficient density estimation.

[0070] Construct a normalized flow model consisting of multiple stacked coupled layers. Each layer processes the input vector as follows: Perform the transformation: a) Input Divided into two parts: and .

[0071] b) Output Calculated according to the following rules: ; .

[0072] in, and These are scaling and translation transformation functions defined by neural networks (such as multilayer perceptrons). This represents element-wise multiplication. The inverse transformation is easy to compute, and its Jacobian determinant is a triangular matrix with a determinant value of... It is easy to differentiate.

[0073] For the residual value output by an upper-layer network By performing a forward propagation and using the above formula, the logarithmic probability density of this normalized flow model can be directly and accurately calculated. Set a dynamic or static probability threshold. ,like If the residual is found to be abnormal, then the probability of abnormality can be used as part of the dual indicators in step S104.

[0074] Step S104 embodies the intelligent decision-making logic of this invention, upgrading from single judgment to hierarchical decision-making. A two-dimensional judgment framework is constructed by combining the model uncertainty from step S102 and the anomaly probability from step S103. A threshold interval system is built to identify three states by setting threshold intervals for each of the two indicators. The first state is model uncertainty (high uncertainty), indicating that the model has encountered an unfamiliar situation, possibly a new attack or drastic environmental change. In this case, instead of drawing conclusions blindly, learning is triggered. The second state is model certainty and network normalcy (low uncertainty and low anomaly probability), indicating that the system is in a high-confidence security state, maintaining routine operations. The third state is model certainty and a threat exists (low uncertainty but high anomaly probability), indicating that the model has confidently identified a threat, requiring immediate action. This mechanism effectively distinguishes between insufficient model awareness and a firm belief in the existence of a threat, greatly improving the rationality and reliability of the decision.

[0075] Step S105 is crucial for achieving the system's adaptive capability, forming a complete closed loop from perception to decision-making to evolution. Executing different strategies for different states demonstrates the system's intelligence.

[0076] For the first type of state, an online learning mechanism is triggered. This is the core of resolving data distribution discrepancies and concept drift. As described in the disclosure document, the system samples historical normal data from the FIFO experience replay buffer, mixes it with new data that triggers uncertainty, incrementally trains the LSTM network, and updates the GMM model using the online EM algorithm. This allows the model to continuously adapt to environmental changes while avoiding catastrophic forgetting through replay. For the second type of state: maintaining the status quo to ensure business continuity. For the third type of state: triggering pre-defined intervention and handling procedures, such as firewall blocking and session termination analyzed in the disclosure document, to achieve proactive defense.

[0077] With S105, the entire system is no longer a static model, but a living system that can learn from actual combat and optimize itself over time, thus maintaining a high-precision situational awareness capability over a long period of time.

[0078] In some embodiments, the method employs an online EM algorithm to update the Gaussian mixture model of the probability distribution using data under two states. The steps include: calculating the posterior probability of the data under the two states belonging to each component of the probability distribution as a responsibility value; using the responsibility value to update the sufficient statistics of the Gaussian mixture model; and updating the parameters of the Gaussian mixture model based on the updated sufficient statistics.

[0079] In the adaptive network security situation awareness system constructed in this invention, to achieve continuous tracking of the dynamically evolving network normal behavior baseline by the Gaussian mixture model, in some embodiments, an online EM algorithm is used to incrementally update the probability distribution model. The specific steps include: when the system determines that the network is in a Class II state of "model deterministic and normal," the data sample corresponding to that moment is considered a valid sample representing the current normal mode and is then used to trigger the GMM update process; first, the posterior probability of the new sample belonging to each Gaussian component in the GMM is calculated, and this probability serves as the responsibility value, quantifying the likelihood of the sample being generated by different components; then, the system uses this responsibility value as a weight to update the sufficient statistics of each Gaussian component using weighted averages. These sufficient statistics are the basis for calculating the model parameters; finally, based on the updated sufficient statistics, the various parameters of the GMM are recalculated and adjusted, including the mixture weights, mean vector, and covariance matrix of each component. This streaming processing mechanism enables GMM to smoothly and progressively adjust parameters using only newly arrived normal samples without retraining the entire model. This ensures that its probability density estimation can reflect the slow evolution of normal network behavior over time in real time and accurately, effectively combating concept drift. At the same time, due to its extremely low computational overhead, it perfectly meets the stringent requirements of lightweight and real-time performance in edge computing scenarios, making it one of the key technical links for the entire system to achieve continuous self-evolution.

[0080] In some embodiments, the method further includes: actively initiating updates to the time-series data prediction model and the probability distribution according to a specified time interval.

[0081] In the adaptive network security situation awareness system constructed in this invention, in addition to the online learning mechanism actively triggered by the high uncertainty of the model, a key safeguard update strategy is introduced, namely, actively initiating updates to the time-series data prediction model and probability distribution at specified time intervals. This design aims to address the potential risks of relying solely on event-driven updates, namely, when the network environment undergoes slow and gradual conceptual drift, the model may fail to trigger updates due to a prolonged lack of significant changes sufficient to induce high uncertainty, thus causing its knowledge system to gradually lag behind the actual environment and resulting in implicit performance degradation. By setting a fixed time period (e.g., 24 hours), the system can strongly safeguard against updates. By periodically initiating a round of incremental model updates, regardless of the current level of uncertainty, this ensures that the model can periodically acquire and learn all recent "normal" data within a time window, including subtle behavioral pattern changes that may not have been captured by uncertainty indicators. This periodic update and uncertainty-driven update form a perfect functional complement, together constituting a double insurance mechanism. It can respond quickly to sudden and significant changes in data distribution, and can also periodically calibrate for slowly evolving environmental changes. This fundamentally eliminates the possibility of the model failing due to long-term stagnation, greatly enhancing the system's robustness, adaptability, and continuous reliability of situational awareness under long-term deployment.

[0082] In some embodiments, the method maintains the current network configuration for the two types of states, including: continuous monitoring and logging, system health checks and maintenance, execution of security policies and configurations, and reporting and visualization of network security situation awareness results; The preset intervention and handling process is triggered for the three types of states, including: performing network layer isolation, terminating sessions and connections, performing host layer containment, performing full traffic packet capture, triggering the preset investigation script of the security orchestration and response platform to find threats, and generating alarm prompts and reporting.

[0083] In the adaptive network security situation awareness system described in this invention, the differentiated response strategies executed for different states classified after risk assessment are the core of achieving intelligent operation and maintenance and proactive defense: When the system is determined to be in a Class II state (model determined and network normal), the executed "maintain current network configuration" is not a simple laissez-faire approach, but a proactive operation and maintenance combination aimed at ensuring business continuity, accumulating operation and maintenance knowledge, and laying the foundation for long-term system health. Its specific content includes tracking network health status and building historical baselines through continuous monitoring and logging; performing system health checks and maintenance to ensure the reliable operation of each component of the awareness pipeline (e.g., updating experience replay buffers); gently executing the verification and optimization of security policies and configurations to improve security posture without interfering with business; and reporting and visualizing the network security situation awareness results, thereby providing administrators with a credible understanding and decision-making basis that "everything is normal." Conversely, when the system is determined to be in a Class III state, the triggered "pre-set intervention and handling process" is a layered, multi-pronged automated emergency response system, the first of which... The primary objective is to rapidly contain threats, including immediately implementing network-layer isolation (such as blocking the source IP via API calls to the firewall), terminating sessions and connections to break the attack chain, and performing host-layer containment (such as isolating or suspending infected instances) to prevent lateral movement. Simultaneously, deep analysis and forensics are initiated, tracing the attack source, assessing the scope of impact, and identifying related threat indicators by performing full-traffic packet capture and triggering pre-defined investigation scripts on the security orchestration and response platform. Furthermore, the system synchronously generates alerts and reports, notifying the security team through the highest priority channels and automatically creating emergency response tickets. This seamlessly integrates automated response with human decision-making, forming a complete closed loop from accurate perception to rapid containment, and then to deep analysis and collaborative response. Ultimately, this significantly improves the network's ability to respond promptly to high-confidence security threats and enhances its overall security level.

[0084] On the other hand, the present invention provides an adaptive network security situation awareness device that incorporates online learning, including a processor, a memory, and a computer program or instructions stored in the memory. The processor is used to execute the computer program or instructions, and when the computer program or instructions are executed, the device performs the steps of the above-described method.

[0085] On the other hand, the present invention provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0086] On the other hand, the present invention provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method.

[0087] The present invention will now be described with reference to a specific embodiment: This embodiment provides a network security situational awareness method based on LSTM-GMM and online learning, aiming to address the bottlenecks in computational efficiency and real-time performance, as well as the problems of data distribution discrepancies and concept drift in existing technologies. By organically combining an LSTM temporal prediction network, a GMM probability distribution fitting model, and an uncertainty-driven online learning mechanism, it achieves continuous perception, anomaly detection, and adaptive evolution of network behavior. This system not only enables high-precision modeling and anomaly detection of network behavior but also achieves autonomous evolution and continuous optimization of the model in the face of changes in data distribution or new attack patterns. The overall process is as follows: Figure 2 As shown.

[0088] Specifically, it includes the following key steps: Step 1: Data Input and Real-Time Model Inference a) Data Acquisition and Preprocessing. The system continuously collects real-time network stream data from multiple data sources, including network traffic (such as TCP / UDP traffic statistics) and system load indicators (CPU / memory / disk utilization). These data constitute multimodal time series, and after preprocessing operations such as data cleaning and missing value imputation, they form regular time series segments suitable for model input.

[0089] Data cleaning: Inspect and remove completely duplicate records, such as duplicate data caused by data acquisition system failures. Unify the time and numerical formats of different data sources, normalize continuous data features to the [0,1] interval, and perform one-hot encoding on categorical features. Remove obviously illogical data, such as negative network traffic or CPU utilization exceeding 100%.

[0090] Missing value imputation: For continuous data features, linear interpolation is used to impute missing points. If the data has obvious periodicity, periodic interpolation can be combined. For categorical features, if interpolation cannot be used, the mode is used for imputation.

[0091] b) Temporal Prediction and Uncertainty Quantification. Preprocessed temporal data is input into an LSTM temporal prediction network, which employs the MC Dropout technique, maintaining Dropout activation during the inference phase. The MC Dropout technique enables Dropout not only during model training but also during prediction to approximate Bayesian inference. Traditional inference processes use deterministic outputs, performing one forward propagation to obtain a single prediction result, which can be expressed as: However, after introducing MC Dropout, the operation becomes: .in, and This represents a randomly generated binary mask.

[0092] Perform T forward propagations (e.g., T=50) on the same input sample, each time using a different random mask, to obtain a set of distributions of predicted values. Calculate the predicted mean based on this distribution. As the final prediction result, the prediction variance is calculated. As a measure of the model's uncertainty regarding the current sample.

[0093] c) Residual Calculation and Probabilistic Modeling. Gaussian Mixture Models (GMMs) are used for probability distribution fitting. Since the residual distribution in a real system may not be a simple normal distribution, but rather exhibit a complex shape with multiple peaks, a GMM is used to fit its probability density. GMMs approximate distributions of arbitrary shapes by weighted sums of multiple Gaussian distributions, and their probability density function... Defined as: .

[0094] in, It is the number of Gaussian components. It is the first The mixed weights of the components, and It is a standard Gaussian distribution: .

[0095] This model allows us to calculate the probability of any new residual value occurring, thereby determining whether it is abnormal.

[0096] d) Dual indicator output. Prediction uncertainty, quantified by the prediction variance Var(y*) generated by MC Dropout. Anomaly probability, calculated by GMM.

[0097] Step 2: Risk assessment based on dual indicators and online learning initiation mechanism The system combines the uncertainty and anomaly probability output from the first step to conduct a three-level risk assessment and execute differentiated decisions, as shown in Table 1 below.

[0098] Table 1 Risk Assessment Level Table

[0099] In addition, as a safeguard mechanism, the system will also force an online learning session after a fixed time window T (e.g., T=24 hours), which means the process will proceed to Step 3.

[0100] Step 3: Uncertainty-Driven Online Learning and Model Evolution a) Intelligent triggering. Trigger the system's online learning mechanism in Step 2.

[0101] b) Data Preparation and Buffering. The system maintains a fixed-capacity M First-In-First-Out (FIFO) buffer, continuously storing historical data samples and their sequence contexts that the model classifies as "normal" (i.e., the probability of anomaly is below a threshold). When online learning is triggered, a batch of data is randomly sampled from the current buffer and mixed with the latest received data that triggers high uncertainty, forming a fine-tuning dataset.

[0102] c) Incremental model update and training.

[0103] Incremental updates to the LSTM network involve using the aforementioned fine-tuning dataset to perform incremental training on the LSTM network over a few cycles, updating its weights to adapt to the new data distribution, and using the same loss function as during the training process.

[0104] The Gaussian Mixture Model (GMM) incremental update employs the online EM algorithm, using newly arrived "normal" samples to efficiently iteratively update the GMM model's parameters (weights, mean, variance), allowing the "normal" behavior baseline to evolve smoothly. For a newly arrived "normal" sample x(t), the parameters of each Gaussian component i of the GMM... The incremental update follows these rules: First, calculate the posterior probability of a sample belonging to each component; then, update the sufficient statistic of the parameter using this responsibility value; finally, calculate the new parameter value based on the updated statistic. The expression for the weight update is: This incremental update method has minimal computational overhead, allowing the probability distribution of the GMM to adjust smoothly and in real time along with the evolution of the network's normal behavior baseline, ensuring the accuracy of the "normal" behavior boundary.

[0105] d) Model update complete. After the incremental update is completed, the new generation of LSTM and GMM models will replace the old models to process subsequent real-time network streams, thus forming a complete closed loop from perception to decision-making to self-evolution.

[0106] The technical advantages of this solution are as follows: First, multimodal time-series data fusion processing ensures the comprehensiveness of data dimensions, providing a sufficient information foundation for situational awareness. Second, Monte Carlo Dropout quantifies prediction uncertainty, solving the problem of the difficulty in measuring the reliability of traditional model prediction results. Third, the dual-indicator risk assessment mechanism combines prediction uncertainty and threat probability, significantly improving the accuracy of situational judgment and avoiding misjudgment based on a single indicator. Fourth, online learning is triggered for uncertain model states, using incremental updates of the model and probability distribution based on two types of state data to achieve dynamic model adaptation and enhance the adaptability to changes in the network environment. Fifth, the classification and handling process makes network security response more targeted, ensuring both normal network operation efficiency and timely handling of security threats, effectively improving the intelligence and reliability of network security protection.

[0107] Corresponding to the above method, the present invention also provides an apparatus / system including a computer device, the computer device including a processor and a memory, the memory storing computer instructions, the processor executing the computer instructions stored in the memory, and when the computer instructions are executed by the processor, the apparatus / system performs the steps of the method as described above.

[0108] This invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the aforementioned edge computing server deployment method. The computer-readable storage medium can be a tangible storage medium, such as random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, floppy disks, hard disks, removable storage disks, CD-ROMs, or any other form of storage medium known in the art.

[0109] In summary, the adaptive network security situation awareness method and device combining online learning described in this invention quantifies the uncertainty of time-series prediction results by introducing Monte Carlo Dropout technology and combining it with anomaly probability detection based on Gaussian mixture models to construct a dual-index intelligent evaluation system of "prediction uncertainty - anomaly probability". This enables the system to accurately distinguish between three fundamentally different situations: model cognitive blind spots, certain normal states, and certain security threats. On this basis, the system achieves a closed loop from perception to decision-making through a differentiated response mechanism driven by uncertainty and matched to state. It can not only immediately execute preset handling procedures to achieve rapid containment when a threat is certain, but also intelligently trigger online learning when the model's cognition is insufficient. It uses historical normal data in the experience replay buffer to perform collaborative incremental updates to the prediction model and probability distribution, thereby enabling the entire system to have a powerful self-evolutionary capability to continuously track the evolution of network behavior and smoothly adapt to concept drift. Ultimately, while maintaining lightweight computing characteristics, it effectively solves the fundamental problems of insufficient real-time performance and poor long-term adaptability faced by traditional static models in edge computing scenarios.

[0110] Those skilled in the art will understand that the exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention. When implemented in hardware, it can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this invention are programs or code segments used to perform the desired tasks. The programs or code segments can be stored in a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried in a carrier wave.

[0111] It should be clarified that the present invention is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of the present invention.

[0112] In this invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or in place of features of other embodiments.

[0113] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, various modifications and variations of the embodiments of the present invention are possible. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. An adaptive cyber-security situation awareness method incorporating online learning, characterized by, The method comprises the following steps: Collecting network state data and system load index data of real-time network data flow from a preset data source, and forming a multi-modal time sequence segment after data preprocessing; Inputting the multi-modal time sequence segment of the current period into a pre-trained time sequence data prediction model through a sliding window to output a predicted value and its uncertainty of the multi-modal time sequence segment of the next period; wherein the time sequence data prediction model is activated by Monte Carlo Dropout during prediction, a set number of forward propagations are performed on a single input, the predicted mean value is taken as the predicted value, and the predicted variance is taken as the uncertainty to measure the certainty of the prediction result; Fitting the probability distribution of the residual value of the predicted value and the true value of a plurality of historical periods, and calculating the probability of the residual value between the predicted value and the true value of the next period to measure the network threat; Based on a preset threshold interval system, using the uncertainty and the probability of the next period to perform double-index risk assessment, dividing a class of states with model uncertainty, a class of states with model certainty and a network normality, and a class of states with model certainty and network threat, realizing network security situation awareness; For the first class of states, triggering online learning, sampling the data under the second class of states recorded in the data buffer for incremental updating of the time sequence data prediction model and updating of the probability distribution; for the second class of states, maintaining the current network configuration; for the third class of states, triggering a preset intervention treatment process.

2. The adaptive cyber security situation awareness method incorporating online learning as claimed in claim 1, wherein, The data preprocessing includes removing repeated values and abnormal values of the network state data and the system load index data, filling missing values based on linear interpolation method, and feature normalization operation.

3. The adaptive cyber security situation awareness method incorporating online learning as claimed in claim 1, wherein, The time sequence data prediction model is pre-trained based on a long short-term memory network, a time convolution network or a Transformer model, and the pre-training steps include: Obtaining a training data set containing sample network state data and sample system load index data in a normal state, and combining to obtain a multi-modal sample time sequence segment; Using a sliding window to continuously extract a multi-modal sample time sequence segment of a set length period to input an initial time sequence data prediction model, the initial time sequence data prediction model performs a set number of forward propagations on the same input, and outputs a predicted mean value and a predicted variance of a multi-modal sample time sequence segment of the next period; the training sample set is used to train the initial time sequence data prediction model, and the Monte Carlo Dropout is used for activation, the loss is constructed based on the deviation of the predicted value and the true value for parameter updating, and the time sequence data prediction model is obtained; The calculation formula of the predicted mean value is: ； The calculation formula of the predicted variance is: ； represents the predicted mean, T represents the set number; represents the predicted value obtained by the tth forward propagation; represents the predicted variance.

4. The adaptive cyber security situation awareness method incorporating online learning as claimed in claim 1, wherein, Fitting the probability distribution of the residual value of the predicted value and the true value of a plurality of historical periods includes: using a Gaussian mixture model or a normalized flow model to fit the probability distribution.

5. The adaptive cyber security situation awareness method incorporating online learning as claimed in claim 4, wherein, The method uses an online EM algorithm to update the Gaussian mixture model of the probability distribution based on the data under the second class of states, and the steps include: The posterior probabilities of the data belonging to each component of the probability distribution in the second type state are calculated as responsibility values, sufficient statistics of the Gaussian mixture model are updated using the responsibility values, and parameters of the Gaussian mixture model are updated based on the updated sufficient statistics.

6. The adaptive cyber security situation awareness method incorporating online learning as claimed in claim 1, wherein, The method further comprises: actively initiating updating of the time series data prediction model and the probability distribution according to a specified time interval length.

7. The adaptive cyber security situation awareness method incorporating online learning as claimed in claim 1, wherein, In the method, the current network configuration is maintained for the second type state, including: continuous monitoring and log recording, system health check and maintenance, execution of security policies and configurations, and reporting and visualization of network security situation awareness results; For the third type state, a preset intervention treatment process is triggered, including: executing network layer isolation, terminating sessions and connections, executing host layer containment, executing full-flow packet capture, triggering a preset investigation script of a security orchestration and response platform to find threats, and generating an alarm prompt and reporting.

8. An adaptive cyber-security situation awareness apparatus incorporating online learning, comprising a processor, a memory, and a computer program or instructions stored on the memory, wherein, The processor is configured to execute the computer program or instructions, and when the computer program or instructions are executed, the apparatus implements the steps of the method according to any one of claims 1 to 7.

9. A computer readable storage medium having stored thereon a computer program or instructions, characterized in that, The computer program or instructions are executed by the processor to implement the steps of the method according to any one of claims 1 to 7.

10. A computer program product comprising computer programs or instructions, characterized in that, The computer program or instructions are executed by the processor to implement the steps of the method according to any one of claims 1 to 7.

Images