Intelligent edge security threat real-time interception and early warning method

Abstract

The invention discloses an intelligent edge security threat real-time interception and early warning method, which relates to the technical field of edge computing, and comprises the following steps: collecting operation data of process behavior logs, network flow characteristics and hardware state parameters through a built-in lightweight sensor interface of edge equipment; redundant information is removed through feature screening, and the data scale is simplified through dimension compression; deploying a lightweight neural network model optimized by channel pruning and knowledge distillation at edge equipment, reasoning the preprocessed data in real time and outputting a threat probability value; differential response is realized based on at least two levels of threat judgment thresholds, high-risk threats trigger local process isolation, network blocking and other rapid interception, and suspicious threats start early warning and directionally upload data to a cloud; and the cloud collaboration system utilizes a high-precision deep neural network to secondarily verify suspicious data, generates a threat feature update package, encrypts and distributes the threat feature update package to each edge device through federal learning, and realizes incremental update of an edge model.

Description

Technical Field

[0001] This invention relates to the field of edge computing technology, specifically to an intelligent method for real-time interception and early warning of edge security threats. Background Technology

[0002] The explosive growth of edge computing, driven by scenarios such as 5G, industrial internet, and power IoT, has led to the decentralization of computing. Massive amounts of sensitive data are being processed at the edge, making it a high-value target for attacks.

[0003] Edge devices are widely distributed and resource-constrained, posing a series of bottlenecks to traditional centralized protection systems. These include insufficient real-time performance, with long-distance data transmission causing response delays and an inability to meet millisecond-level decision-making needs in scenarios such as the power IoT and industrial control. Dynamic threats are becoming increasingly complex, with the heterogeneity and protocol diversity of IoT devices introducing a large attack surface. Industrial Internet monitoring in 2024 showed that abnormal traffic events accounted for 34.8%, and the number of brute-force attacks surged 183 times year-on-year. Data privacy is also a challenge, as sensitive data such as distribution radio areas and user behavior need to be processed locally, but the high computational overhead of traditional encryption technologies is difficult to adapt to edge devices.

[0004] The dynamic nature of edge environments demands that security policies possess adaptive capabilities. For example, EDR technology, through full lifecycle behavior monitoring (from file scanning to process tracing), can identify covert attack chains such as "rundll32.exe loading an unknown DLL and connecting to port 443," and coordinate with firewalls and SIEM systems to form a closed loop of "detection-analysis-response." Furthermore, the combination of federated learning and differential privacy can enhance the model's generalization ability.

[0005] Therefore, there is an urgent need for an intelligent method for real-time interception and early warning of edge security threats, given the limited computing power and storage of edge devices and the difficulty in deploying traditional deep neural networks. Summary of the Invention

[0006] To address the aforementioned technical challenges, this paper presents an intelligent method for real-time interception and early warning of edge security threats. This solution overcomes the limitations of computing power and storage on edge devices, which makes traditional deep neural networks difficult to deploy.

[0007] To achieve the above objectives, the technical solution adopted by the present invention is as follows: A method for intelligent real-time interception and early warning of edge security threats, comprising: Real-time operational data is collected through the lightweight sensor interface built into the edge device. The operational data includes process behavior logs, network traffic characteristics, and hardware status parameters. The operational data is preprocessed, including feature filtering and dimensionality compression, retaining key threat identification features and removing redundant data. A lightweight neural network model with model compression is deployed in an edge device. The lightweight neural network model is processed by channel pruning and knowledge distillation. The lightweight neural network model is used to perform real-time inference on the preprocessed running data and output threat probability values. Set at least two threat determination thresholds. When the threat probability value is higher than the first threshold and lower than the second threshold, trigger a local warning on the edge device and upload suspicious data fragments to the cloud collaboration system. When the threat probability value is higher than the second threshold, immediately activate the local interception mechanism on the edge device, including process isolation, network connection blocking, and locking of critical files. The cloud-based collaborative system receives suspicious data fragments uploaded by edge devices, performs secondary verification using a high-precision deep neural network model, and generates a threat feature update package. The threat feature update package is then encrypted and distributed to each edge device through a federated learning mechanism, enabling incremental updates of the lightweight neural network model.

[0008] Preferably, the acquisition of real-time operational data through the lightweight sensor interface built into the edge device specifically includes: Three types of operational data are collected in parallel through the lightweight sensor interface built into the edge device: Process behavior logs include process ID, creation time, parent process relationship, sensitive file access records, and dynamic link library loading paths; Network traffic characteristics include source / destination IP address, port number, protocol type (TCP / UDP / ICMP), packet length distribution, session duration, and anomaly flags; Hardware status parameters, including CPU utilization, memory usage, disk I / O frequency, temperature sensor readings, and firmware verification values; The collected data is timestamped and standardized in format, and then uniformly converted into structured data. Non-numerical features are converted into numerical vectors through one-hot encoding.

[0009] Preferably, the preprocessing of the running data specifically includes: Key threat identification features are retained, a threat feature association map is constructed, and the mapping relationship between key features and known threats is defined through expert rules. An improved Relief-F algorithm is used to calculate feature importance, that is, to calculate the contribution of each feature to the sample classification for each type of threat. Key features within the preset importance ranking range are retained, redundant features are eliminated, and the feature dimension is compressed to below the preset ratio.

[0010] Preferably, the preprocessing of the running data further includes: Dimension compression involves performing principal component analysis on the screened features, calculating the feature covariance matrix, selecting the top k principal components whose cumulative contribution rate is greater than or equal to a predetermined proportion, mapping the high-dimensional feature vectors to a k-dimensional subspace, and further compressing the dimensions to the preset proportion of the original screened dimensions. A sliding window mechanism is introduced to filter noise, and the 3σ criterion is used to remove outliers from the time series features, retaining valid data that conforms to the normal distribution; exponential smoothing is applied to the hardware state parameters. The output is a compressed low-dimensional feature vector, ensuring that each preprocessed data point is less than or equal to a predetermined size, thus meeting the storage and transmission needs of edge devices.

[0011] Preferably, the lightweight neural network model specifically includes: The lightweight neural network model selects a basic deep neural network suitable for threat detection and pre-trains it in the cloud using a large-scale threat sample dataset, including normal / abnormal process behavior and network traffic characteristics, so that the model has a preliminary threat identification capability. Channel pruning involves evaluating the importance of channels in the convolutional layers of the pre-trained model by calculating the L1 norm of the output features of each channel to quantify their importance; setting a pruning threshold to remove redundant channels; and fine-tuning the pruned model to recover the accuracy loss caused by pruning. Knowledge distillation uses the pruned model as the student model and the unpruned original pre-trained model as the teacher model. A distillation loss function is constructed so that the student model can fit the soft labels output by the teacher model while learning the sample labels. The smoothness of the soft labels is adjusted by a temperature coefficient. Distillation training is performed on similar datasets of edge devices so that the student model can inherit the generalization ability of the teacher model. The distilled model is converted into a lightweight format compatible with edge devices and then quantized; the model inference engine is optimized in combination with the hardware characteristics of edge devices.

[0012] Preferably, the step of performing real-time inference on the preprocessed operational data and outputting a threat probability value specifically includes: Receive preprocessed edge device operation data and input it into the lightweight model; The model calculates the probability value of corresponding data belonging to various threats through forward propagation; it normalizes the probability values ​​of multiple threats and takes the maximum value as the final threat probability value for subsequent threshold determination. If the real-time resource occupancy of the edge device exceeds the preset threshold, the model inference strategy will be automatically adjusted: only the first 3 layers of the lightweight model will be enabled for fast inference to ensure normal device operation. The complete inference process will be restored after the resource occupancy decreases.

[0013] Preferably, setting at least two levels of threat determination thresholds specifically includes: Two basic thresholds are preset based on the type of edge device. The first threshold is the warning threshold, which corresponds to the preset warning level risk probability judgment standard. The second threshold is the interception threshold, with the threat probability value set at 0.8-0.9. The threshold for high-security scenarios is lowered by a predetermined ratio to prioritize security. By combining recent threat handling history data from edge devices, thresholds are dynamically adjusted using a proportional hazards model to ensure that the thresholds are adapted to the actual operating environment of the devices. The threat probability value output by the lightweight neural network is received and compared with the currently effective two-level threshold. When the probability value is less than the first threshold, it is judged as normal behavior, and only data is recorded to the local log; when the probability value is greater than or equal to the first threshold and less than the second threshold, it is judged as a suspicious threat and the local early warning process is triggered; when the probability value is greater than or equal to the second threshold, it is judged as a high-risk threat and the local interception mechanism is immediately activated.

[0014] Preferably, the edge device local interception mechanism specifically includes: Local alerts for suspicious threats trigger local alarms on edge devices and push alert information, including threat type, occurrence time, and involved processes / ports, to the bound administrator terminal; suspicious behavior is temporarily marked without interrupting normal business operations. Targeted data upload extracts data fragments directly related to suspicious behavior, compresses the data volume using an incremental hash algorithm, and uploads only the differences; a lightweight encryption protocol is used to encrypt the data fragments, which are then uploaded to the cloud through a low-priority channel; Local interception of high-risk threats, process isolation, calling the kernel-level isolation interface of the edge device's operating system to move suspicious processes into an independent namespace and restrict their access to system resources; Network blocking: Dynamically update edge firewall rules to immediately block network connections of suspicious processes and record connection traces; Critical files are locked. Read-only locking is enabled for critical files such as system configuration files, firmware images, and sensitive user data. The lock status remains until manual confirmation or cloud verification is required to unlock them. After local interception, an interception report is automatically generated, including the trigger threshold, handling measures, and scope of impact, and is forcibly uploaded to the cloud first. If the cloud secondary verification determines that it is a false interception, the interception is remotely lifted through encrypted commands, and dynamic calibration of the threshold of the edge device is triggered.

[0015] Preferably, the cloud-based collaborative system receives suspicious data fragments uploaded by edge devices, specifically including: The cloud-based collaborative system receives encrypted and suspicious data fragments uploaded by edge devices through a dedicated interface, decrypts them using an asymmetric encryption algorithm, and verifies the data signature to ensure that the data source is trustworthy and has not been tampered with; it splices fragmented data in time sequence to supplement global threat intelligence in the cloud and form a complete sample; and it converts the data into a format compatible with high-precision models. The high-precision model undergoes secondary verification by calling a high-precision deep neural network model deployed in the cloud to infer the pre-processed complete sample and output fine-grained threat classification results and confidence levels. Cross-validation is performed by combining the cloud threat intelligence database and the historical behavior baseline of edge devices. If the model inference result matches the intelligence database to a predetermined proportion and deviates from the historical baseline to a predetermined standard deviation, it is determined to be a confirmed threat. If a suspected threat identified by an edge device is verified as normal behavior in the cloud, it is recorded as a false alarm case for subsequent edge model optimization. The threat feature update package targets newly identified threats by extracting core features of interest to the localization model through gradient-weighted class activation mapping, and extracting them into feature vectors of a preset dimension. The update package includes the new threat feature vector and classification label, parameter adjustment values ​​for the corresponding layer of the edge lightweight model, and feature correction rules for false positive cases. The update package is compressed using the LZ77 compression algorithm and then encrypted using AES-256 to generate an encrypted update package with a timestamp.

[0016] Preferably, the step of encrypting and distributing the threat signature update package to each edge device through a federated learning mechanism specifically includes: The cloud groupes edge devices based on their type, with devices in the same group sharing similar threat scenarios; it also broadcasts encrypted update packages and corresponding federated learning tasks to each group of nodes. After receiving the update packet, the edge device decrypts it in the local trusted execution environment, uses the feature samples in the update packet to fine-tune its own lightweight model, and only calculates and uploads the gradient difference of the model parameters. The cloud uses a federated averaging algorithm to aggregate the gradient differences of edge devices in the same group, assigns weights according to the contribution of node data, and generates global update parameters; the aggregated parameters are then smoothed. The cloud distributes the smoothed global update parameters in encrypted form to the edge devices in the corresponding groups, and the nodes only update the layers in the model that are related to the new threat. After the edge device is updated, it automatically selects local historical data for verification, calculates the changes in threat identification accuracy and false alarm rate, and encrypts the verification results and sends them back to the cloud. The cloud collects feedback data from all groups. If the accuracy of a certain group's model increases by a predetermined percentage and the false positive rate decreases by a predetermined percentage, the update is confirmed to be effective; otherwise, a second optimization is triggered, forming a closed-loop iteration.

[0017] Compared with the prior art, the beneficial effects of the present invention are as follows: From the perspective of edge operating efficiency, this invention optimizes and adapts to the characteristics of edge devices through data preprocessing and a lightweight model. When collecting data through a lightweight sensor interface, it focuses on three core dimensions: process, network, and hardware, avoiding redundant data from consuming resources. In the preprocessing stage, invalid information is eliminated through feature filtering and dimensional compression, significantly reducing the amount of data input for subsequent inference. The lightweight neural network model, after channel pruning and knowledge distillation, greatly reduces the parameter scale and computational overhead while sacrificing minimal accuracy, ensuring efficient operation of real-time inference. This solves the pain point that traditional deep neural networks are difficult to deploy at the edge, ensuring that edge devices can still quickly output threat probability values ​​under low computing power and low storage conditions.

[0018] In terms of the accuracy and timeliness of threat handling, the multi-level threshold judgment mechanism enables differentiated responses. High-risk threats trigger rapid local interception, using measures such as process isolation and network blocking to immediately block attacks and prevent further losses. Suspicious threats trigger local alerts and targeted data uploads, reducing the impact of false interceptions on business operations and providing accurate samples for cloud verification. Secondary verification using a high-precision cloud model can correct potential misjudgments at the edge, improving threat identification accuracy and forming a dual guarantee of initial edge screening and cloud verification, balancing real-time response and judgment accuracy. Attached Figure Description

[0019] Figure 1 This is a flowchart of an intelligent method for real-time interception and early warning of edge security threats. Detailed Implementation

[0020] The following description is intended to disclose the invention and enable those skilled in the art to implement it. The preferred embodiments described below are merely examples, and other obvious variations will occur to those skilled in the art.

[0021] Reference Figure 1 As shown, an intelligent method for real-time interception and early warning of edge security threats includes: Real-time operational data is collected through the lightweight sensor interface built into the edge device. The operational data includes process behavior logs, network traffic characteristics, and hardware status parameters. The operational data is preprocessed, including feature filtering and dimensionality compression, retaining key threat identification features and removing redundant data. A lightweight neural network model with model compression is deployed in an edge device. The lightweight neural network model is processed by channel pruning and knowledge distillation. The lightweight neural network model is used to perform real-time inference on the preprocessed running data and output threat probability values. Set at least two threat determination thresholds. When the threat probability value is higher than the first threshold and lower than the second threshold, trigger a local warning on the edge device and upload suspicious data fragments to the cloud collaboration system. When the threat probability value is higher than the second threshold, immediately activate the local interception mechanism on the edge device, including process isolation, network connection blocking, and locking of critical files. The cloud-based collaborative system receives suspicious data fragments uploaded by edge devices, performs secondary verification using a lightweight neural network model, and generates a threat feature update package. The threat feature update package is then encrypted and distributed to each edge device through a federated learning mechanism to achieve incremental updates of the lightweight neural network model.

[0022] It should be noted that the lightweight model is: Channel pruning reduces the number of model parameters by more than 50% by removing redundant channels in the neural network, making it compatible with embedded devices with less than 128MB of memory; knowledge distillation uses a high-precision teacher model in the cloud to output soft labels to guide the marginal student model to learn potential feature associations, compensating for the accuracy loss caused by pruning; and Pareto optimality is achieved between model accuracy and resource consumption.

[0023] Privacy-enhanced data upload mechanism Suspicious data fragments (not the original full data) are uploaded only when the threat probability is at the first threshold (warning interval), and the fragment hash value is matched against the cloud threat database; differential privacy technology is used to add Gaussian noise (ε≤0.5) to the uploaded fragments to prevent attackers from inferring the device status through the data fragments; the GDPR data minimization principle is met to avoid the risk of edge data leakage.

[0024] The acquisition of real-time operational data through the lightweight sensor interface built into the edge device specifically includes: Three types of operational data are collected in parallel through the lightweight sensor interface built into the edge device: Process behavior logs include process ID, creation time, parent process relationship, sensitive file access records, and dynamic link library loading paths; Network traffic characteristics include source / destination IP address, port number, protocol type (TCP / UDP / ICMP), packet length distribution, session duration, and anomaly flags; Hardware status parameters, including CPU utilization, memory usage, disk I / O frequency, temperature sensor readings, and firmware verification values; The collected data is timestamped and standardized in format, and then uniformly converted into structured data. Non-numerical features are converted into numerical vectors through one-hot encoding.

[0025] The preprocessing of the operational data specifically includes: Key threat identification features are retained, a threat feature association map is constructed, and the mapping relationship between key features and known threats is defined through expert rules. An improved Relief-F algorithm is used to calculate feature importance, that is, the contribution of each feature to the sample classification is calculated for each type of threat. Key features within a preset importance ranking range (e.g., 30%) are retained, redundant features are eliminated, and the feature dimension is compressed to a preset proportion (e.g., 1 / 3) or less.

[0026] The preprocessing of the operational data also includes: Dimension compression involves performing principal component analysis on the filtered features, calculating the feature covariance matrix, selecting the top k principal components whose cumulative contribution rate is greater than or equal to a predetermined proportion, and mapping the high-dimensional feature vectors to a k-dimensional subspace, thereby further compressing the dimensions to the preset proportion of the original filtered dimensions (such as 1 / 4). A sliding window mechanism is introduced to filter noise, and the 3σ criterion is used to remove outliers from the time series features, retaining valid data that conforms to the normal distribution; exponential smoothing is applied to the hardware state parameters. The output is a compressed low-dimensional feature vector, ensuring that each preprocessed data point is less than or equal to a predetermined size, thus meeting the storage and transmission needs of edge devices.

[0027] It should be noted that the data acquisition layer: Lightweight sensor interface, hardware-software collaborative data acquisition, process behavior logging, dynamic mounting of security probes via Linux kernel eBPFHook to capture events such as process creation and file access with a performance loss of <3%; network traffic characteristics, zero-copy packet capture based on DPDK user-space driver, supporting 100Gbps line-speed processing (suitable for 5G base station scenarios); hardware status parameters, reading sensor data by calling IPMI2.0 remote management interface, integrating RAPL (RunningAveragePowerLimit) energy monitoring module to detect abnormal power consumption attacks; achieving full-dimensional data capture with <5% CPU overhead, breaking through resource constraint bottlenecks.

[0028] Spatiotemporal consistency and high-precision time synchronization are achieved by using the IEEE 1588PTP protocol (accuracy ±100ns) to unify the device clock and ensure the traceability of events across sensors. Non-numerical feature encoding: process relationship tree → graph embedding vector (GraphSAGE algorithm generates 128-dimensional features); sensitive file path → Bloom filter hash value (false positive rate <0.1%); eliminates the dimensionality explosion problem of traditional one-hot encoding (original features 10^4-dimensional → compressed to 10^2-dimensional).

[0029] Preprocessing layer: expert-AI fusion strategy for feature selection, construction of threat feature association graph, and transformation of MITREATT&CK tactical technology base into knowledge graph (Neo4j storage). The Relief-F algorithm is improved by differentiating weights between classes, increasing the weight of APT attack samples by 3 times, thus enhancing the detection capability of advanced threats; feature interaction evaluation is performed to calculate the importance of second-order combined features, such as "sudden increase in CPU utilization + unconventional port external connection"; Dimensionality compression, incremental principal component analysis (IPCA), and dynamic updates to the covariance matrix avoid full recalculation (reducing resource consumption by 90%):

[0030] In the formula, Let be the covariance matrix at time t; This is the forgetting factor, used to balance the influence of new and old data; here, its value is set to 0.99. For time t The covariance matrix of 1; This is the data vector at time t; for The transpose of , i.e., a row vector; The weight of the new data is 0.01, which means that the new data contributes little to the update of the covariance matrix. The sliding window's adaptive mechanism dynamically adjusts the window size according to the threat frequency: a large window (60s) is used for low-frequency attacks (such as zero-day exploits), while a small window (5s) is used for high-frequency attacks (such as DDoS attacks); the robustness of the 3σ criterion is enhanced by using the median absolute deviation (MAD) instead of the standard deviation to resist outlier interference.

[0031] The lightweight neural network model specifically includes: The lightweight neural network model is selected based on a fundamental deep neural network suitable for threat detection, with MobileNetV3 / ShuffleNetV2 (for general scenarios) and TCN-Lite (for scenarios primarily based on temporal features) being preferred. The selection range can be further expanded based on the computing power level of the edge device and the feature dimensions of threat detection (static / temporal / hybrid), or a customized construction based on a multi-branch modular architecture can be adopted. Customized networks must reserve interfaces for compatibility with the hardware architecture of edge devices (such as ARM, RISC-V). All selections must meet the core requirements of supporting channel pruning, knowledge distillation, and quantization, and must be verified through actual testing on edge devices, with a real-time inference latency of <20ms and a model size of <5MB. At the same time, the recognition accuracy on typical threat detection datasets must not be lower than a preset threshold, adapting to the resource constraints of edge devices and the real-time requirements of threat detection.

[0032] The model is pre-trained in the cloud using a large-scale threat sample dataset, including normal / abnormal process behavior and network traffic characteristics, so that it has a preliminary threat identification capability. Channel pruning involves evaluating the importance of channels in the convolutional layers of the pre-trained model by calculating the L1 norm of the output features of each channel to quantify their importance; setting a pruning threshold to remove redundant channels; and fine-tuning the pruned model to recover the accuracy loss caused by pruning. Knowledge distillation uses the pruned model as the student model and the unpruned original pre-trained model as the teacher model. A distillation loss function is constructed so that the student model can fit the soft labels output by the teacher model while learning the sample labels. The smoothness of the soft labels is adjusted by a temperature coefficient. Distillation training is performed on similar datasets of edge devices so that the student model can inherit the generalization ability of the teacher model. The distilled model is converted into a lightweight format compatible with edge devices and then quantized; the model inference engine is optimized in combination with the hardware characteristics of edge devices.

[0033] The process of performing real-time inference on the preprocessed operational data and outputting a threat probability value specifically includes: Receive preprocessed edge device operation data and input it into the lightweight model; The model calculates the probability value of corresponding data belonging to various threats through forward propagation; it normalizes the probability values ​​of multiple threats and takes the maximum value as the final threat probability value for subsequent threshold determination. If the real-time resource occupancy of the edge device exceeds the preset threshold, the model inference strategy will be automatically adjusted: only the first N layers of convolutional structures set by the lightweight model (e.g., N is set to 3) will be enabled for fast inference to ensure normal device operation. The complete inference process will be restored after the resource occupancy decreases.

[0034] It should be noted that the lightweight neural network model is as follows: Channel pruning uses the L1 norm instead of the L2 norm to evaluate channel importance because L1 is more sensitive to sparse features. Inter-layer dependency analysis is introduced so that when a channel of a convolutional layer is pruned, the number of input channels in the next layer is adjusted simultaneously to avoid feature map dimensionality mismatch. Fine-tuning training employs adversarial training, injecting adversarial examples generated by FGSM to enhance the model's robustness to attack sample perturbations; the learning rate decays layer by layer, with deeper parameters using a smaller learning rate to protect the learned abstract features from being destroyed.

[0035] Knowledge distillation: soft label construction, dynamic adjustment of temperature coefficient τ, using a higher τ (τ=3) for highly confusing samples to preserve the details of the teacher model's decision-making; using τ=1 for clear samples to accelerate convergence; Feature layer distillation forces the intermediate layer feature maps of the student model to maintain similarity with those of the teacher model, except for the soft labels in the output layer (using Huber loss to mitigate feature scale differences).

[0036] Edge distillation employs generative data augmentation, utilizing VAEs to synthesize threat samples that closely approximate the distribution of edge devices, thus addressing the problem of insufficient local samples at the edge.

[0037] Edge deployment: Asymmetric quantization uses INT8 quantization for model weights, but retains the precision of the last FP16 layer to prevent distortion of probability output; operator fusion compilation merges Conv-BN-ReLU into a single operator to reduce memory accesses. Heterogeneous hardware adaptation involves optimizing kernel scheduling strategies for NPUs (such as Huawei Ascend) and GPUs (such as NVIDIA Jetson), such as prioritizing convolution calculations for NPUs and optimizing parallel thread allocation for GPUs.

[0038] Real-time inference: The first three convolutional layers focus on basic features, such as the distribution of network traffic packet size and process CPU usage cycle, which can cover 80% of known threat patterns; the deep network is responsible for detecting advanced APT behaviors, such as fileless attacks; when resources exceed the limit, a feature caching mechanism is activated to temporarily store the features required by the deep layer locally, and complete the calculation after the resources are released. Flexible resource threshold settings dynamically adjust thresholds based on device type: industrial gateways (CPU > 70% triggers degradation), smart cameras (CPU > 50% triggers degradation), avoiding protection failure caused by a one-size-fits-all approach. Multi-dimensional decision-making through probabilistic fusion: Temporal correlation analysis introduces a sliding window mechanism to perform a weighted average of threat probabilities over 10 consecutive inference cycles (with higher weight for recent ones) to suppress instantaneous false alarms, such as abnormal behavior triggered by device firmware upgrades; Two lightweight models are run in parallel, and a manual review process is triggered when the probability difference between the two is >0.3 to reduce the risk of model degradation.

[0039] The setting of at least two levels of threat determination thresholds specifically includes: Two basic thresholds are preset based on the type of edge device. The first threshold is the warning threshold, such as a threat probability value set to 0.6-0.7, which corresponds to the preset warning level risk probability judgment standard. The second threshold is the interception threshold, with a threat probability value set to 0.8-0.9. The threshold for high-security scenarios is lowered by a predetermined ratio to prioritize security. By combining recent threat handling history data from edge devices, thresholds are dynamically adjusted using a proportional hazards model to ensure that the thresholds are adapted to the actual operating environment of the devices. The threat probability value output by the lightweight neural network is received and compared with the currently effective two-level threshold. When the probability value is less than the first threshold, it is judged as normal behavior, and only data is recorded to the local log; when the probability value is greater than or equal to the first threshold and less than the second threshold, it is judged as a suspicious threat and the local early warning process is triggered; when the probability value is greater than or equal to the second threshold, it is judged as a high-risk threat and the local interception mechanism is immediately activated.

[0040] The edge device local interception mechanism specifically includes: Local alerts for suspicious threats trigger local alarms on edge devices and push alert information, including threat type, occurrence time, and involved processes / ports, to the bound administrator terminal; suspicious behavior is temporarily marked without interrupting normal business operations. Targeted data upload extracts data fragments directly related to suspicious behavior, compresses the data volume using an incremental hash algorithm, and uploads only the differences; a lightweight encryption protocol is used to encrypt the data fragments, which are then uploaded to the cloud through a low-priority channel; Local interception of high-risk threats, process isolation, calling the kernel-level isolation interface of the edge device's operating system to move suspicious processes into an independent namespace and restrict their access to system resources; Network blocking: Dynamically update edge firewall rules to immediately block network connections of suspicious processes and record connection traces; Critical files are locked. Read-only locking is enabled for critical files such as system configuration files, firmware images, and sensitive user data. The lock status remains until manual confirmation or cloud verification is required to unlock them. After local interception, an interception report is automatically generated, including the trigger threshold, handling measures, and scope of impact, and is forcibly uploaded to the cloud first. If the cloud secondary verification determines that it is a false interception, the interception is remotely lifted through encrypted commands, and dynamic calibration of the threshold of the edge device is triggered.

[0041] It should be noted that there are two levels of thresholds: In high-security scenarios, the thresholds will be lowered by 10%-15% (warning threshold 0.55, interception threshold 0.75), sacrificing some false alarm rate for security redundancy; low-risk devices (smart home gateways) will maintain the baseline values ​​to avoid frequent alarm interference. The core algorithm of dynamic learning uses a proportional hazards model (CoxModel) to analyze historical interception data.

[0042] In the formula, Let X be the hazard function for time t, given the covariate X, which is the instantaneous rate of an event occurring. The baseline hazard rate is the hazard rate when all covariates X are 0, and it changes with time t. It is an exponential function; and covariates and Weighting coefficients; The number of false positives in the past 7 days is a covariate. The number of false positives in the past 7 days is a covariate. Tiered decision-making: Gray zone buffer mechanism, the early warning interval (0.6-0.8) is essentially an attack behavior observation window: continuously monitor latent attacks such as port scanning and low-frequency brute-force attacks for 5-10 cycles to avoid premature interception and exposure of defense strategies; Threshold jump protection: When the threat probability suddenly increases from 0.5 to 0.85 (such as when the ransomware encryption process starts), it bypasses the warning and directly intercepts the attack, compressing the response delay to within 50ms and blocking the golden attack window (<200ms). Local interception mechanism, a zero-trust practice with kernel-level isolation:

[0043] Data upload: Incremental hashing algorithm optimization, using Rabin fingerprinting + Bsdiff differential encoding, only uploaded changed data blocks; Encryption protocol selection, using XChaCha20-Poly1305 (ARMv8 encryption instruction acceleration) on resource-constrained devices, which improves throughput by 3 times compared to AES-GCM and resists side-channel attacks; Interception cancellation: Cloud-based secondary verification, using multi-model voting arbitration, with 3 heterogeneous models (CNN+LSTM+GNN) analyzing independently, and the cancellation command is only triggered if ≥2 of them are determined to be false alarms; Local self-learning calibration, threshold-triggered reinforcement learning based on false interception events (PPO algorithm): New threshold = Old threshold + α * (1 - Cloud confidence level) In the formula, α = 0.01 is the learning rate, which takes effect when the confidence level is ≥ 0.95; Risk control: Circuit breaker strategy for false blocking, three-level circuit breaker mechanism: If a single device falsely blocks ≥3 times within 24 hours, the threshold will be automatically increased by 0.05. False alarm rate of similar device groups > 5% → push hot patch to the cloud for the model; Key business processes are added to a whitelist digital fingerprint database (SHA3-256 hash value verification).

[0044] Advanced escape attack response, low-speed attack detection, baseline modeling of process startup behavior for processes that have been in the warning range (0.6-0.8) for a long time, and upgrading to interception if the detection deviation is >2σ; Kernel rootkit defense: During interception, the SM3 hash value of the process's memory pages is simultaneously verified and compared with a trusted database in the cloud to block fileless attacks.

[0045] The cloud-based collaborative system receives suspicious data fragments uploaded by edge devices, specifically including: The cloud-based collaborative system receives encrypted and suspicious data fragments uploaded by edge devices through a dedicated interface, decrypts them using an asymmetric encryption algorithm, and verifies the data signature to ensure that the data source is trustworthy and has not been tampered with; it splices fragmented data in time sequence to supplement global threat intelligence in the cloud and form a complete sample; and it converts the data into a format compatible with high-precision models. Secondary validation of the high-precision model involves calling upon a cloud-based collaborative system. This system leverages the computing power of cloud server clusters / GPUs / TPUs to utilize a high-precision deep neural network model (selected specifically based on the threat detection feature type; for example, lightweight ResNet-50 is preferred for general network threat detection, TCN-BiLSTM hybrid model for time-series industrial control threat detection, and lightweight Vision Transformer (ViT-Tiny) for multimodal threat detection). This model infers from the pre-processed complete samples, outputting fine-grained threat classification results and confidence levels. Cross-validation is then performed using a cloud-based threat intelligence database and historical behavior baselines of edge devices. If the model's inference results match the intelligence database at a predetermined ratio and deviate from the historical baseline at a predetermined standard deviation, the threat is confirmed. Furthermore, advanced models with corresponding precision can be called based on the threat level (e.g., lightweight EfficientNet-B4 is used for verification of highly concealed threats to ensure no missed detections). If a suspected threat identified by an edge device is verified as normal behavior in the cloud, it is recorded as a false alarm case for subsequent edge model optimization. The threat feature update package targets newly identified threats by extracting core features of interest to the localization model through gradient-weighted class activation mapping, resulting in feature vectors of a preset dimension (e.g., 20). The update package includes the new threat feature vector and classification label, parameter adjustment values ​​for the corresponding layer of the edge lightweight model, and feature correction rules for false positive cases. The update package is compressed using the LZ77 compression algorithm and then encrypted using AES-256 to generate an encrypted update package with a timestamp.

[0046] The specific steps of encrypting and distributing the threat signature update package to each edge device through a federated learning mechanism include: The cloud groupes edge devices based on their type, with devices in the same group sharing similar threat scenarios; it also broadcasts encrypted update packages and corresponding federated learning tasks to each group of nodes. After receiving the update packet, the edge device decrypts it in the local trusted execution environment, uses the feature samples in the update packet to fine-tune its own lightweight model, and only calculates and uploads the gradient difference of the model parameters. The cloud uses a federated averaging algorithm to aggregate the gradient differences of edge devices in the same group, assigns weights according to the contribution of node data, and generates global update parameters; the aggregated parameters are then smoothed. The cloud distributes the smoothed global update parameters in encrypted form to the edge devices in the corresponding groups, and the nodes only update the layers in the model that are related to the new threat. After the edge device is updated, it automatically selects local historical data for verification, calculates the changes in threat identification accuracy and false alarm rate, and encrypts the verification results and sends them back to the cloud. The cloud collects feedback data from all groups. If the accuracy of a certain group's model increases by a predetermined percentage and the false positive rate decreases by a predetermined percentage, the update is confirmed to be effective; otherwise, a second optimization is triggered, forming a closed-loop iteration.

[0047] It should be noted that cloud-based collaborative processing: Trustworthy data restoration with quantum security at the forefront: data is decrypted using the CRYSTALS-Kyber post-quantum asymmetric encryption algorithm (NIST2024 standard) and the hash signature based on SPHINCS+ is verified simultaneously. Temporal splicing utilizes Hidden Markov Models (HMMs) to reconstruct the attack chain, splicing fragmented behaviors uploaded from the edge, such as "process injection → privilege escalation operation → external connection to C2 server", into a complete attack sequence, filling the blind spots of single-point perspectives; High-precision verification: Three-stage verification architecture, high-precision model inference → fine-grained classification → threat intelligence matching → matching degree ≥85% → behavioral baseline deviation detection → deviation ≥3σ → threat confirmation; The baseline modeling is adaptive, with dynamic weighting of historical behavioral baselines, 60% weighting for the data from the past 7 days, and 30% weighting for seasonal periodic patterns, to avoid misjudging legitimate changes as abnormal.

[0048] Feature extraction and Gradient-weighted class activation mapping (Grad-CAM++) optimization are employed. An attention mechanism is introduced when locating core threat features to focus on cross-layer feature correlations (such as the spatiotemporal coupling between network traffic anomalies and process memory modifications).

[0049] Federated learning distribution, grouping strategy:

[0050] Gradient protection and differential privacy injection are implemented. Laplace noise (ε=0.3) is added before the gradient is uploaded by the edge device to ensure that the data of a single device cannot be inverted. Trusted Execution Environment (TEE) is built on ARMCCA2.0 to dynamically construct a secure enclave. The key never leaves the TEE to defend against physical side-channel attacks. Feedback-driven weighting, formula for calculating data contribution weights:

[0051] In the formula, The weight of the data contribution of the i-th node; Let be the data volume of the i-th node, that is, the number of data points contained in this node; Let be the false alarm rate of the i-th node, which is the proportion of normal data that is incorrectly identified as abnormal data; The secondary optimization trigger mechanism will be triggered when any of the following conditions occur after the group update: accuracy improvement <5% and false positive rate decrease <3%, or resource consumption increase >15% (to prevent model bloat).

[0052] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the claimed invention. The scope of protection claimed by the appended claims and their equivalents is defined.

Claims

1. An intelligent edge security threat real-time interception and early warning method, characterized in that, The method comprises the following steps: Collecting real-time running data through a lightweight sensor interface built in the edge device, wherein the running data comprises process behavior logs, network traffic characteristics and hardware state parameters; Preprocessing the running data, Including feature screening and dimension compression, retaining key features for threat identification and eliminating redundant data; Deploying a lightweight neural network model processed by model compression in the edge device, wherein the lightweight neural network model is processed by channel pruning and knowledge distillation; using the lightweight neural network model to perform real-time inference on the preprocessed running data, and outputting a threat probability value; Setting at least two levels of threat determination thresholds, when the threat probability value is higher than the first threshold and lower than the second threshold, triggering local pre-warning of the edge device and uploading suspicious data segments to the cloud collaborative system; when the threat probability value is higher than the second threshold, immediately starting the local interception mechanism of the edge device, including process isolation, network connection blocking and key file locking; The cloud collaborative system receives the suspicious data segments uploaded by the edge device, performs secondary verification using a high-precision deep neural network model, and generates a threat feature update package; the threat feature update package is encrypted and distributed to each edge device through a federated learning mechanism, realizing incremental update of the lightweight neural network model. 2.The intelligent edge security threat real-time interception and early warning method of claim 1, wherein, The lightweight neural network model specifically comprises: The lightweight neural network model selects a basic deep neural network suitable for threat detection, pre-trains the model in the cloud using a large-scale threat sample dataset including normal / abnormal process behavior and network traffic characteristics, so that the model has preliminary threat identification capability; Channel pruning, importance evaluation of channels of the pre-trained model, L1 norm quantization importance of each channel output feature is calculated; a pruning threshold is set to eliminate redundant channels; the pruned model is fine-tuned to recover the accuracy loss caused by pruning; Knowledge distillation, the pruned model is used as a student model, and the original pre-trained model without pruning is used as a teacher model; a distillation loss function is constructed to make the student model learn sample labels while fitting the teacher model's soft labels, and the smoothness of the soft labels is adjusted by a temperature coefficient; the student model inherits the generalization ability of the teacher model through distillation training on the same data set in the edge device; The distilled model is converted into a lightweight format compatible with the edge device and is quantized; the model inference engine is optimized in combination with the hardware characteristics of the edge device. 3.The intelligent edge security threat real-time interception and early warning method of claim 2, wherein, The real-time inference on the preprocessed running data to output a threat probability value specifically comprises: Receiving preprocessed edge device running data and inputting the lightweight neural network model; The model calculates the probability value of each type of threat through forward propagation, normalizes the multi-threat probability values, and takes the maximum value as the final threat probability value for subsequent threshold determination; If the real-time resource occupancy rate of the edge device exceeds the preset threshold, automatically trigger model inference strategy adjustment: only enable the preset first N layers of convolution structure of the lightweight neural network model for fast inference to ensure the normal operation of the edge device, and restore the complete inference process after the resource occupancy decreases.

4. The intelligent edge security threat real-time interception and early warning method according to claim 1, characterized in that, The setting at least two levels of threat determination threshold specifically includes: The two-level basic threshold is preset based on the edge device type, the first threshold is a warning threshold corresponding to the preset warning level risk probability determination standard, and the second threshold is an interception threshold, wherein the high security scene threshold is lowered by a certain proportion, and the security is preferentially ensured; Combined with the recent threat disposal history data of the edge device, the threshold is dynamically adjusted through the proportional hazards model to ensure that the threshold adapts to the actual operating environment of the edge device; The threat probability value output by the lightweight neural network model is received, and compared with the currently effective two-level threshold; When the probability value is less than the first threshold, it is determined as normal behavior, and only the data is recorded to the local log; when the probability value is greater than or equal to the first threshold and less than the second threshold, it is determined as a suspicious threat, and a local warning process is triggered; when the probability value is greater than or equal to the second threshold, it is determined as a high-risk threat, and a local interception mechanism is immediately started.

5. The intelligent edge security threat real-time interception and early warning method according to claim 4, characterized in that, The local interception mechanism of the edge device specifically includes: Local warning operation of suspicious threats, triggering local alarm of the edge device, and pushing warning information including threat type, occurrence time, involved process / port to the bound administrator terminal; temporarily marking suspicious behavior, but not interrupting normal business operation; Directional data upload, extracting data segments directly related to suspicious behavior, compressing data volume through incremental hash algorithm, and uploading only the difference; using lightweight encryption protocol to encrypt the data segments, and uploading to the cloud collaborative system through a low-priority channel; Local interception of high-risk threats, process isolation, calling the kernel-level isolation interface of the edge device operating system to move the suspicious process into an independent namespace and limit its access to system resources; Network blocking, dynamically updating edge firewall rules to immediately block the network connection of the suspicious process and record the connection trail; Key file locking, enabling read-only locking for key files such as system configuration files, firmware images, and user sensitive data, and the locking state lasts until manual confirmation and cloud verification are removed; After local interception, an interception report is automatically generated, including trigger threshold, disposal measures, and impact range, and is forced to be uploaded to the cloud collaborative system in priority; if the cloud collaborative system determines that it is a false interception in the secondary verification, the interception is remotely removed through an encrypted instruction, and the edge device threshold is dynamically calibrated.

6. The intelligent edge security threat real-time interception and early warning method according to claim 1, characterized in that, The cloud collaborative system receives suspicious data fragments uploaded by the edge device specifically includes: The cloud collaborative system receives encrypted suspicious data fragments uploaded by the edge device through a special interface, decrypts them using an asymmetric encryption algorithm, and verifies the data signature at the same time to ensure that the data source is trusted and has not been tampered with; time sequence splicing of fragmented data, supplementing cloud global threat intelligence, forming a complete sample; convert the data into a format compatible with high-precision models; High-precision model secondary verification, calling the high-precision deep neural network model deployed in the cloud to infer the complete sample after preprocessing, and outputting the fine-grained threat classification result and confidence; combined with the cloud threat intelligence library and the edge device historical behavior baseline for cross verification, if the model inference result matches the cloud threat intelligence library by more than or equal to a certain proportion, and deviates from the edge device historical behavior baseline by more than or equal to a certain number of standard deviations, it is determined as a confirmed threat; For suspicious threats determined by the edge device, if the cloud collaborative system verifies it as normal behavior, it is recorded as a false positive case for subsequent edge device model optimization; Threat feature update package, for the confirmed new threat, through gradient weighted class activation mapping to locate the core features that the model pays attention to, and extract the feature vector of the preset dimension; the threat feature update package includes the new threat feature vector and classification label, the parameter adjustment value of the corresponding layer of the edge device lightweight neural network model, and the feature correction rule of the false positive case; the threat feature update package is compressed in volume by using the LZ77 compression algorithm, and then encrypted by AES-256 to generate a timestamped encrypted update package.

7. The intelligent edge security threat real-time interception and early warning method according to claim 6, characterized in that, The encrypted threat feature update package is distributed to each edge device through a federated learning mechanism, which specifically includes: The cloud collaborative system groups the edge devices according to their types, and edge devices in the same group share similar threat scenarios; the encrypted update package and the corresponding federated learning task are broadcasted to each group of edge devices; After receiving the encrypted update package, the edge device decrypts it in the local trusted execution environment, fine-tunes its lightweight neural network model using the feature samples in the encrypted update package, and only calculates and uploads the gradient difference of the model parameters; The cloud collaborative system aggregates the gradient differences of the edge devices in the same group using the federated averaging algorithm, assigns weights according to the data contribution of the edge devices, and generates global update parameters; the aggregated global update parameters are smoothed; The cloud collaborative system distributes the smoothed global update parameters to the edge devices in the corresponding group, and the edge devices only update the layers related to the new threat in the model; After updating, the edge device automatically selects local historical data for verification, calculates the change value of threat recognition accuracy and false positive rate, and feeds back the verification result to the cloud collaborative system; The cloud collaborative system statistics the feedback data of all groups, if the model accuracy of a certain group improves by more than or equal to a certain proportion and the false positive rate decreases by more than or equal to a certain proportion, the update is confirmed to be effective; otherwise, trigger secondary optimization to form a closed loop iteration.

8. The intelligent edge security threat real-time interception and early warning method according to claim 1, characterized in that, The real-time running data collected through the built-in lightweight sensor interface of the edge device specifically includes: Three types of running data are collected in parallel through the built-in lightweight sensor interface of the edge device: Process behavior log, including process ID, creation time, parent process relationship, sensitive file access record, dynamic link library loading path; Network traffic features, including source / destination IP address, port number, protocol type (TCP / UDP / ICMP), packet length distribution, session duration, abnormal flag; Hardware state parameters, including CPU occupancy, memory usage, disk IO frequency, temperature sensor reading, firmware checksum; The collected data is time-stamped, aligned and standardized in format, and converted into structured data, wherein non-numeric features are converted into numeric vectors through one-hot encoding.

9. The intelligent edge security threat real-time interception and early warning method according to claim 8, characterized in that, The preprocessing of the operation data specifically includes: Key features for threat identification are retained, a threat feature correlation graph is constructed, a mapping relationship between key features and known threats is defined through expert rules, an improved Relief-F algorithm is used to calculate feature importance, i.e., the contribution of features to sample classification is calculated for each type of threat, key features within a preset importance ranking range are retained, redundant features are removed, and the feature dimension is compressed to a preset proportion or less.

10. The intelligent edge security threat real-time interception and early warning method of claim 9, wherein, The preprocessing of the operation data also includes: Dimension compression, principal component analysis is performed on the screened features, a feature covariance matrix is calculated, the first k principal components with a cumulative contribution rate greater than or equal to a predetermined proportion are selected, high-dimensional feature vectors are mapped to a k-dimensional subspace, and the dimension is further compressed to a preset proportion of the original screened dimension; A sliding window mechanism is introduced to filter noise, 3σ criteria is used to remove outliers for time series features, and effective data conforming to normal distribution is retained; exponential smoothing is performed on hardware state parameters; The compressed low-dimensional feature vector is output, ensuring that a single preprocessed data is less than or equal to a predetermined size, and adapting to the storage and transmission requirements of edge devices.

Images